Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects unauthorized access, creation, or modification of sensitive credential and token files (e.g., OAuth tokens, AWS credentials, gcloud tokens) in common user directories like AppData or .config by processes other than established browsers or legitimate cloud CLI tools. This behavior is indicative of credential theft or SaaS pivot attacks.
Maps the behavioral sequence of a user mounting an ISO/IMG file (which bypasses MOTW) and subsequently executing a payload originating from the new virtual drive.
Detects malicious UnityPlayer.dll reading the encrypted Com.dat container for decryption routines, indicative of the 'Dragon Weave' campaign.
This rule detects attempts by non-browser processes to access sensitive web browser credential files such as 'Login Data', 'key4.db', and 'logins.json'. This activity is highly indicative of credential dumping or information theft, as legitimate browser processes are excluded from the detection.
Detects suspicious access attempts by non-native processes to sensitive application data such as Discord local state, Telegram tdata, Steam SSFN tokens, and Roblox session cookies. This activity could indicate an attempt to steal session tokens or credentials for unauthorized access.
This rule detects the loading of a machine learning model (e.g., Pickle, PyTorch, or Hugging Face model files) via Python, immediately followed by the creation of a Windows Executable (PE) or Shared Object (.so) file on disk by the same initiating process. This behavior is indicative of an embedded stage-2 loader within a malicious model file, often seen in backdoored Large Language Models (LLMs). The time correlation between the model loading and the file drop is set to 45 seconds to identify immediate post-load execution.
Detects unauthorized access (File Creation, Modification, Rename, or Deletion) to common web browser cookie and credential storage files by non-browser processes. This behavior is a common indicator of information-stealing malware attempting to extract session cookies and credentials for later use.
Detects instances where non-browser processes access sensitive browser-related files (Login Data, Cookies, or Local State) located within AppData directories. This behavior is highly indicative of credential and session token theft, often associated with AiTM or post-compromise information harvesting activities.
This rule detects attempts by unsigned or suspicious processes (often residing in temporary directories) to access sensitive cryptocurrency wallet files such as 'wallet.dat', keystore JSON files, and files containing recovery seed phrases. This behavior is indicative of credential theft commonly associated with infostealer campaigns like DeepLoad and DeerStealer.
Detects instances where a process not associated with a known web browser attempts to read sensitive browser credential stores (such as Chrome Login Data, Edge Login Data, or Firefox key4.db/logins.json). This behavior is characteristic of infostealers attempting to extract saved browser credentials.
Detects recursive listing or search commands targeting OneDrive directories from a shell or script interpreter. This activity could indicate an attacker attempting to discover sensitive files within a user's OneDrive.
This rule detects when the 'Groups.xml' file within the SYSVOL folder is read. This file can contain sensitive credential information, such as passwords for service accounts, if Group Policy Preferences (GPP) were used to deploy them. Attackers often target this file to extract credentials for privilege escalation or lateral movement.
Detects Python enumerating browser extensions and desktop wallet paths associated with cryptocurrency key material. This rule specifically looks for Python processes executing with command-line arguments containing keywords related to cryptocurrency wallets (e.g., 'wallet', 'keystore', 'metamask').
Detects Python recursively searching repositories for .env files, package credentials, API keys, access tokens, or connection strings. This activity is associated with the InvisibleFerret malware.
This rule detects suspicious bulk access and transfer behavior targeting sensitive files, which could indicate data exfiltration. It identifies scenarios where a single account accesses a large number of files, totaling a significant size, within a short timeframe. The rule specifically looks for common sensitive file types such as spreadsheets, documents, PDFs, SQL databases, and backup files. This pattern is often associated with ransomware groups performing data leak extortion without encryption.
SYSTEM-Context PST or OST Collection
Cortex XDR
This rule detects suspicious access to Outlook data files (.pst or .ost) by processes running in the SYSTEM context, excluding legitimate Outlook-related processes. It focuses on identifying non-standard applications or scripts attempting to collect mailbox data, potentially indicating data exfiltration or unauthorized access. The rule leverages causality fields for enhanced investigation.
Identifies the PHP or VBS payload iterating through roaming profiles to extract high-value cryptocurrency files (wallet.dat, key4.db, .kdbx). This rule specifically looks for file access events on these sensitive files when initiated by 'cscript.exe' (VBScript host) or 'php.exe' (PHP interpreter).
Detects PHP runtime processes anomalously accessing the .env file, bypassing normal application routing to directly scrape database credentials.
This rule detects potential credential harvesting activity associated with the Hannibal Stealer. It looks for non-standard processes (processes other than the browsers themselves) that access sensitive browser credential stores (like 'Login Data', 'cookies.sqlite', or 'key4.db') and correlate these file access events with the loading of 'bcrypt.dll' or 'CefSharp.BrowsersSubprocess.dll', which are often used for decryption or browser automation/sub-processes during credential theft.
This rule detects when non-FileZilla processes attempt to read or access sensitive FileZilla configuration files, specifically 'recentservers.xml' or 'sitemanager.xml', which are known to store plain-text credentials for site connections. This behavior is indicative of credential harvesting.
Detects pythonw.exe accessing multiple distinct browser credential stores within a tight 2-minute window, indicative of information stealer behavior (e.g., Vidar stealer). The rule specifically looks for access to 'Login Data', 'Cookies', 'Web Data', and 'places.sqlite' files.
Page 63 of 76