Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects access to Chrome Login Data SQLite file for credential theft
Detects access to .env files that may contain plaintext credentials
Detects when a non-Outlook process running as SYSTEM accesses Outlook mailbox data files (.pst or .ost). This rule focuses on identifying suspicious access to sensitive email data outside of normal application behavior, retaining principal and target context for correlation.
This rule detects when a process other than Firefox itself attempts to access critical Firefox profile artifacts such as key4.db, cert9.db, logins.json, cookies.sqlite, places.sqlite, formhistory.sqlite, and prefs.js. This activity is highly suspicious as these files contain sensitive user data including credentials, browsing history, and preferences, and are typically targeted by malware for data exfiltration or credential theft. The rule leverages causality fields for investigation into the actor and the causal process.
This rule detects suspicious activity where a malicious DLL (AggregatorHost.dll) is injected into a process that then explicitly interacts with 'steam.exe' by accessing its files. This behavior is indicative of malware targeting Steam users, potentially to steal credentials or items.
Identifies cmd.exe executing a batch script named 'vvvv.cmd' which is checking for the presence of the 'u.dat' reinfection guard file in the Public\Documents folder before execution. This behavior is associated with the UnregStealer malware.
This rule detects suspicious activity where a Python process initiates network communication to known command and control (C2) domains, immediately followed by accessing SQLite database files (e.g., 'places.sqlite' or 'Cookies'). This pattern is indicative of malware or adversary activity attempting to exfiltrate browser history or session cookies after establishing C2.
Detects unauthorized access to the .npmrc file by unusual processes. Miasma targets this file to hijack NPM publishing rights and propagate supply chain attacks. The rule specifically looks for file access events on '.npmrc' where the initiating process is not a known legitimate NPM-related tool like 'npm', 'node', 'bun', or 'yarn'.
Detects PowerShell accessing browser Local State files to steal credentials. This rule specifically looks for file access events where the file name is 'Local State' and the initiating process is 'powershell.exe' or 'pwsh.exe'.
Detects PowerShell iterating directories for known cryptocurrency wallet extensions and associated strings, indicative of PS1Bot malware activity attempting to harvest wallet data.
Detects Python processes accessing sensitive credential paths, a common post-exploitation step for malicious ML models (e.g., CVE-2026-4372). The rule specifically looks for Python executables accessing paths commonly associated with cloud (AWS) or container (Kubernetes) credentials. It includes exclusions for known legitimate ML pipeline scripts to reduce noise.
Detects unauthorized access to KeePass password database files
Detects access to browser profile data outside of authorized browser processes
Detects unauthorized access to KeePass password database files
Detects access to browser profile data outside of authorized browser processes
This rule detects a high volume of failed object access attempts (EventID 4674) by a single user on a specific computer within a one-hour window. This could indicate an adversary attempting to discover or access sensitive resources, potentially as part of privilege escalation or data exfiltration efforts.
Detects web-based access to log files indicating log tampering attempts
This rule detects attempts to access the NTDS.dit file or the SYSTEM registry hive, indicated by Security Event ID 4656. Multiple access attempts within an hour are summarized by the subject user name.
KQL Query from file: Detection for ShadowHound
This rule detects the Deno runtime accessing sensitive browser profile data (Login Data, Cookies, Local State) and cryptocurrency wallet directories (Wallet, Electrum, Exodus, MetaMask) on the same machine. This dual access pattern is indicative of infostealer malware, often distributed as fake coding utilities. End-user PCs should rarely run Deno, making such activity highly suspicious.
This rule detects suspicious access attempts to file system objects (hard disk volumes or DOS devices) by non-system accounts. It specifically looks for Event ID 4656 (Handle to an Object was Requested) where the ObjectName contains "\Device\HarddiskVolume" or "\DosDevices\", the AccessMask indicates broad access (0x1fffff or 0x120089), and the SubjectUserName is not a standard system account (SYSTEM, LOCAL SERVICE, NETWORK SERVICE). The rule then aggregates these events over one-hour intervals and flags if five or more such access attempts occur from the same computer and user.
Page 66 of 76