Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects bulk file reading from removable media shares for data collection
Detects access to AWS credentials files for cloud account credential theft
Detects anomalous processes targeting modern AI developer credential files and configuration files for tools like Claude, Gemini, and Cursor, a behavior exhibited by IronWorm.
This rule detects suspicious access to the UniFi OS JWT secret file (jwt.yaml) by processes other than the legitimate UniFi core components. It monitors for direct file access events (read, copy) and command-line executions that target the jwt.yaml file. This activity could indicate an attempt to extract sensitive credentials, potentially leading to unauthorized access or privilege escalation within the UniFi environment.
This rule detects a high volume of access attempts (10 or more within an hour) by a single user to sensitive system directories such as 'Admin' or 'System32'. This behavior could indicate an adversary performing file and directory discovery, attempting to access sensitive files, or staging for further malicious activity.
This rule detects when an Outlook OST (Offline Storage Table) file is accessed over SMB (Server Message Block) protocol. The detection is triggered by the presence of the string ".ost" (case-insensitive) in the network traffic on port 445 (SMB). This activity could indicate an attempt to collect local email data.
This rule detects multiple unauthorized access attempts to files identified as machine learning models, weights, or checkpoints. It specifically looks for Security Event ID 4656 (Auditing of object access) where the object name contains keywords like 'model', 'weights', or 'checkpoint', and the access mask indicates unauthorized access attempts (0x0001 for ReadData or ListDirectory, 0x0002 for WriteData or AddFile). The rule then summarizes these attempts by user, computer, and hour, triggering an alert if 5 or more attempts are made within an hour.
This rule detects attempts to exploit a Local File Inclusion (LFI) vulnerability to read the `/etc/passwd` file on a web server. It specifically looks for HTTP requests where the URI contains the string `/etc/passwd`.
This rule detects a high volume of file read operations from a network share that contains the string "USBSTOR" in its content, indicating potential access to removable media. It triggers an alert if more than 50 such events occur within a 30-second window from the same source IP address. This could signify an attempt to exfiltrate data from a removable device shared over the network.
This rule detects attempts to access browser history files, specifically Google Chrome's history, over Server Message Block (SMB) protocol. The detection is triggered when SMB traffic contains the string "History" and "AppData\Local\Google\Chrome" (case-insensitive), indicating a potential reconnaissance activity where an attacker might be trying to exfiltrate or analyze browser history.
Enumerates installed Chrome extensions, cross-references against public blocklists, and flags suspicious permissions.
This rule detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory or the NTDS.dit file, which are common targets for credential dumping. It specifically looks for Security Event ID 4656 (A handle to an object was requested) where the ObjectName is either 'lsass.exe' or 'ntds.dit' and the AccessMask indicates read or all access permissions. The rule then summarizes these events by user, computer, and IP address, flagging if two or more such events occur.
This rule detects repeated access attempts (3 or more within an hour) to critical credential storage processes or files, specifically lsass.exe, the Security Account Manager (SAM) database, or the NTDS.dit file. Such activity is indicative of credential theft attempts by an adversary.
This rule detects multiple unauthorized access attempts to files identified as machine learning models, weights, or checkpoints. It specifically looks for Security Event ID 4656 (Auditing of object access) where the object name contains keywords like 'model', 'weights', or 'checkpoint', and the access mask indicates unauthorized access attempts (0x0001 for ReadData or ListDirectory, 0x0002 for WriteData or AddFile). The rule then summarizes these attempts by user, computer, and hour, triggering an alert if 5 or more attempts are made within an hour.
Detects exclusive file locks used to prevent security tools from accessing files
Detects access to credential files through web shell commands
Detects a Node.js or npm process attempting to read sensitive credential files such as SSH keys, npm tokens, K8s configurations, cloud credentials, or Vault material. This rule is tuned for the Red Hat Cloud Services supply chain attack by monitoring for Node.js/npm processes executing in the context of the affected packages or preinstall hooks.
This rule detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory or the NTDS.dit file, which are common targets for credential dumping. It specifically looks for Security Event ID 4656 (A handle to an object was requested) where the ObjectName is either 'lsass.exe' or 'ntds.dit' and the AccessMask indicates read or all access permissions. The rule then summarizes these events by user, computer, and IP address, flagging if two or more such events occur.
This rule detects suspicious activity related to accessing or dumping the NTDS.dit file, which contains Active Directory credential information. It looks for process creation events involving tools commonly used for NTDS.dit extraction (e.g., ntdsutil, secretsdump), file access events on NTDS.dit paths, and privilege use (SeBackupPrivilege, SeRestorePrivilege, SeDebugPrivilege) often associated with credential dumping.
Detects the initiation of a FileSystemWatcher object in PowerShell configured to monitor the 'Changed' event. This technique is used by GammaSteel to actively monitor user operations in real time and steal documents the moment they are modified.
Detects attempts to read common HashiCorp Vault token paths from the filesystem, indicating potential credential harvesting by the Miasma stealer or other unauthorized access.
Page 67 of 76