Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
This rule detects rapid access to specific classified document types (.doc, .docx, .pdf, .xls) followed by network egress to identified C2 structures within a 5-minute window. It correlates file access events for sensitive document types with subsequent network connections initiated by the same process on the same device.
Detects Python executing OS commands spawned directly from the deserialization of a poisoned Pickle model file. This rule correlates process creation events where 'python.exe' initiates a command interpreter ('cmd.exe', 'sh', 'bash') with file access events to common Pickle file extensions ('.pkl', '.pickle', '.pth', '.bin').
This rule detects attempts by non-browser processes to access browser credential stores (Login Data, Cookies, Web Data). Specifically, it monitors file read, access, or copy actions on known credential database paths for Chrome, Edge, Firefox, Brave, and Opera, and flags any activity originating from processes other than the legitimate browser executables or common security software.
This rule detects repeated access attempts (read or write) to files or directories commonly associated with software build artifacts (e.g., 'build', 'release', 'artifact', 'bin', 'dist'). It specifically looks for Security Event ID 4656, which indicates a handle to an object was requested, and filters out common system accounts to focus on user-initiated access. A high number of access attempts (5 or more) within an hour by a non-system user to these sensitive object names could indicate an attempt to compromise or exfiltrate software supply chain components.
Detects hollowed MsBuild process accessing Discord or Crypto wallet files.
Detects unauthorized processes reading the .bash_history file concurrently with AWS CLI activity, which could indicate an adversary attempting to extract credentials or sensitive information from command history while interacting with AWS services. This behavior is associated with the Megalodon CI/CD malware.
This rule detects when the ScreenConnect process accesses DPAPI-related files, specifically those within the 'Protect\S-1-5-21-' folder. This activity is indicative of credential theft, as observed in the 'Operation SilentCanvas' campaign where a trojanized ScreenConnect was used for this purpose.
Correlates the reading of the '1.dat' container file, which is required for secondary stage decryption, with the execution of 'RuntimeBroker_update.exe'. This activity is indicative of the 'Dragon Weave' campaign.
This rule detects attempts by a malicious cache wrapper (specifically, a process named `._cache_GAME1.exe`) to access local Steam configuration files, which could indicate token harvesting. The rule looks for file access events on paths containing `\config\loginusers.vdf` initiated by the specified malicious process.
Detects access to SSL/TLS private key files by unauthorized processes
Detects access to Chrome Login Data SQLite file for credential theft
This rule detects when package managers like npm, bun, or pnpm access SSH private key files. Such activity can indicate a supply chain attack where a malicious package attempts to exfiltrate sensitive credentials, granting unauthorized access to servers. If this alert fires, investigate the initiating process, check for newly installed software, and audit server logins associated with the compromised SSH key. Involve your security team if the cause is unclear.
This rule detects when a child process of npm (node, bun, or npm itself) reads a Kubernetes service account token file. This activity can indicate a compromised package attempting to access internal Kubernetes clusters from a developer's machine. Such an event warrants investigation into recent software installations or user activity, and engagement with the security team if the cause is unclear.
Detects a non-browser process searching for Chromium Login Data, Cookies, Local State, or Firefox logins and key databases. This activity is indicative of credential access attempts where an attacker tries to extract sensitive information stored by web browsers.
Detects when the 'node.exe' process attempts to read sensitive developer key files such as '.git-credentials', '.npmrc', or 'config.json' directly from disk. This behavior is indicative of a malicious NPM script attempting to harvest local authentication tokens.
Monitors the Node package manager engine performing mass file reads of all .pub files in the SSH keys path. This rule specifically looks for 'node.exe' accessing multiple files ending with '.pub' within folders containing '.ssh'.
Detects PowerShell reading from cryptocurrency extension folders (e.g., MetaMask). This rule specifically looks for file access events where the initiating process is PowerShell (powershell.exe or pwsh.exe) and the accessed folder path contains the unique identifier for a known cryptocurrency extension.
This rule detects an unusually high volume of access attempts (20 or more within an hour) to a user's 'Documents' or 'Desktop' folders. This activity could indicate an adversary attempting to discover or collect sensitive data.
Detects copying of Outlook PST/OST files for email collection
This rule detects suspicious access attempts to file system objects (hard disk volumes or DOS devices) by non-system accounts. It specifically looks for Event ID 4656 (Handle to an Object was Requested) where the ObjectName contains "\Device\HarddiskVolume" or "\DosDevices\", the AccessMask indicates broad access (0x1fffff or 0x120089), and the SubjectUserName is not a standard system account (SYSTEM, LOCAL SERVICE, NETWORK SERVICE). The rule then aggregates these events over one-hour intervals and flags if five or more such access attempts occur from the same computer and user.
Detects reading of process memory via /proc filesystem for credential extraction
Page 65 of 76