Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
This rule detects when 'pythonw.exe' performs a high volume of distinct database file reads (5 or more) within a 3-minute window. This behavior is indicative of potential credential harvesting or data exfiltration by malicious Python scripts, as described in the referenced blog post about threat actors using AI hype in social engineering campaigns.
Detects access to .env files that may contain plaintext credentials
Correlates the user mounting a tax-themed ISO archive followed by the execution of a binary establishing a Remcos RAT C2 connection.
This rule detects repeated access attempts (read or write) to files or directories commonly associated with software build artifacts (e.g., 'build', 'release', 'artifact', 'bin', 'dist'). It specifically looks for Security Event ID 4656, which indicates a handle to an object was requested, and filters out common system accounts to focus on user-initiated access. A high number of access attempts (5 or more) within an hour by a non-system user to these sensitive object names could indicate an attempt to compromise or exfiltrate software supply chain components.
Detects unauthorized reading of the GitHub CLI hosts.yml file by processes other than standard development tools (gh, gh.exe, code). This activity could indicate an attempt to steal authenticated GitHub sessions, as the hosts.yml file contains sensitive GitHub authentication tokens.
Detects suspicious file read or access events targeting cryptocurrency wallet files (e.g., wallet.dat, keystore, .metamask, Exodus wallet) and browser extension data stores (e.g., Chrome Local Extension Settings, MetaMask, BraveSoftware). The rule specifically excludes common browser processes to reduce false positives, indicating an attempt by an unauthorized process to enumerate or scrape sensitive cryptocurrency-related data.
Detects access to AWS credentials files for cloud account credential theft
Detects when a non-Outlook process running as SYSTEM accesses Outlook mailbox data files (.pst or .ost). This rule focuses on identifying suspicious access to sensitive email data outside of normal application behavior, retaining principal and target context for correlation.
Maps the malicious cache wrapper accessing local Steam configuration files for token harvesting.
This rule detects the dynamic compilation of C# code using csc.exe followed by immediate access to DPAPI (Data Protection API) vault files. This sequence of events can indicate an adversary compiling and executing code on the fly to decrypt or access sensitive credentials protected by DPAPI.
Identifies suspicious access to Steam configuration files (loginusers.vdf) by processes other than legitimate Steam applications, combined with network connections to known malicious URLs associated with token theft. This rule aims to detect injected or hidden wrappers attempting to steal Steam tokens.
This rule detects a malicious npm package attempting to read Claude MCP connection settings, which may contain sensitive information like API keys and server details. The theft of MCP configuration could allow attackers to impersonate AI integrations. If this rule triggers, the package should be removed, and any associated API keys should be rotated. Further investigation should involve questioning the user about recent software installations or clicked links, and engaging the security team if the situation remains unclear.
This rule detects the combination of a Node.js process reading a JavaScript file with a 24-character hexadecimal filename, immediately followed by outbound network communication to known command and control (C2) IP addresses associated with the 'easy-day-js' campaign. This behavior is indicative of the Mastra NPM supply chain compromise.
Detects command-line utilities such as grep, cat, sed, awk, or shell commands (bash, sh) being used to read the 'psappsrv.cfg' file and specifically searching for sensitive configuration parameters like 'Address=', 'HostName=', 'appserv', 'prcs', or 'ps_config_homes'. This activity could indicate an attacker attempting to discover system information or network configurations related to Oracle PeopleSoft.
Detects attempts by non-browser processes like Python, Node.js, CScript, or WScript to access browser-related SQLite database files such as 'Login Data', 'Cookies', or 'Web Data'. This activity is indicative of credential access or data exfiltration.
Detects scripts (Python/Node/VBS) directly accessing Chrome or OS-level DPAPI structures (Login Data, Cookies) to extract user credentials.
Correlates the execution of an executable initiated by cscript.exe with the subsequent access of Chrome's 'Login Data' file, indicating an attempt at offline DPAPI decryption, potentially by the Laravel Stealer malware.
Uses time-windowing to detect a single anomalous process rapidly opening multiple telecom billing/radius .xml or .cfg files, indicating automated config parsing prior to exfiltration.
Detects suspicious access to network device configuration files or routing table exports, potentially indicating compromise by the Salt Typhoon threat actor. This rule correlates file access events on critical configuration files (e.g., running-config, startup-config, BGP routes) within sensitive directories with network or remote interactive logons by local administrators.
Detects suspicious file read or access events targeting cryptocurrency wallet files (e.g., wallet.dat, keystore, .metamask, Exodus wallet) and browser extension data stores (e.g., Chrome Local Extension Settings, MetaMask, BraveSoftware). The rule specifically excludes common browser processes to reduce false positives, indicating an attempt by an unauthorized process to enumerate or scrape sensitive cryptocurrency-related data.
Detects suspicious reads of the .git-credentials file by non-git processes. This file often contains plaintext Git passwords or tokens, making it a target for credential theft.
Page 64 of 76