Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
This rule detects attempts to search for sensitive keywords like 'password', 'secret', 'credential', 'creds', 'apikey', 'token', or 'key' using 'findstr.exe' or 'reg.exe'. This activity can indicate an adversary attempting to discover credentials or other sensitive information on a compromised system.
Detects Node.js or Bun processes accessing sensitive developer configuration directories such as .ssh and .npmrc, indicating potential credential harvesting. This rule specifically looks for file access or open events initiated by 'node.exe', 'node', 'bun.exe', or 'bun' processes targeting paths containing '.ssh' or '.npmrc', or files named '.npmrc'.
Detects attempts to read common HashiCorp Vault token paths from the filesystem, indicating potential credential harvesting by malware like Miasma stealer.
Detects suspicious processes attempting to access the Signal Desktop attachments directory. This behavior indicates potential data collection by post-compromise tooling, such as the InboxSetupPro second-stage tool observed in Nimbus RAT campaigns.
Detects file access attempts targeting the erroneous SysWOW64 path for Kaspersky drivers. This is a specific bug and a high-confidence indicator of Amatera Stealer's anti-sandbox and evasion checks. The malware specifically looks for 'klif.sys', 'kldisk.sys', 'klhk.sys', and 'kneps.sys' within the incorrect '\Windows\SysWOW64\drivers' directory.
Detects Node.js or Bun processes accessing sensitive developer configuration directories such as .ssh and .npmrc, indicating potential credential harvesting. This rule specifically looks for file access or open events initiated by 'node.exe', 'node', 'bun.exe', or 'bun' processes targeting paths containing '.ssh' or '.npmrc', or files named '.npmrc'.
Detects file access patterns in the Downloads directory matching cryptocurrency wallet seeds, phrases, and private keys targeted by file grabbers like Amatera. The rule identifies bulk access (more than 3 sensitive files within 5 minutes) to files with specific keywords or extensions commonly associated with crypto wallets.
Node.js Accessing Developer Secrets
Cortex XDR
Detects Node.js processes rapidly reading multiple sensitive developer configuration or credential files (e.g., .env, AWS credentials, SSH keys) within a short timeframe. This behavior is indicative of infostealer activity, often observed with malicious npm packages.
This rule detects attempts by processes other than the legitimate ThreatLocker service to open the 'policies.txt' file located in the ThreatLocker installation directory. This could indicate an attempt to tamper with or exfiltrate ThreatLocker policies.
This rule detects attempts by processes other than the legitimate ThreatLocker service to open the 'policies.txt' file located in the ThreatLocker installation directory. This could indicate an attempt to tamper with or exfiltrate ThreatLocker policies.
Detects exclusive SMB file handle requests (ShareAccess = 0), which are utilized by the GhostLock denial-of-service technique.
GhostLock is a proof-of-concept tool that evades traditional write-based ransomware defenses by locking files rather than encrypting them, causing widespread STATUS_SHARING_VIOLATION errors.
Note: To effectively identify the attack and reduce false positives, implement thresholding/aggregation in your SIEM. It is highly recommended to alert only when the count of these events exceeds 500 within a 5-minute window, grouped by the source 'IpAddress'.
GhostLock is a proof-of-concept tool that evades traditional write-based ransomware defenses by locking files rather than encrypting them, causing widespread STATUS_SHARING_VIOLATION errors.
Note: To effectively identify the attack and reduce false positives, implement thresholding/aggregation in your SIEM. It is highly recommended to alert only when the count of these events exceeds 500 within a 5-minute window, grouped by the source 'IpAddress'.
Detects access to sensitive files, credential data, or remote procedure call (RPC) endpoints related to credential dumping over a network share.
This could indicate lateral movement or remote credential harvesting techniques.
This could indicate lateral movement or remote credential harvesting techniques.
Detects unexpected access to PhoneExperiences-*.db files which may contain synchronized SMS and OTP messages. This behavior is associated with the CloudZ RAT and Pheno plugin bypassing SMS-based MFA.
Kubernetes Service Account Token Theft
Cortex XDR
Detects non-legitimate processes attempting to read Kubernetes service account tokens or related sensitive files (ca.crt, namespace) from the standard service account path within containers. This rule filters out common and legitimate Kubernetes system processes to reduce false positives.
Detects unauthorized processes reading or accessing the 'PhoneExperiences' SQLite databases. This behavior may indicate an attempt to steal synchronized SMS messages or One-Time Passwords (OTPs) via the Microsoft Phone Link application, bypassing MFA without needing mobile malware.
Detects attempts by non-Azure Arc agent processes to access '.key' files within the Azure Arc Tokens directory. This activity could indicate an attempt to exploit CVE-2026-26117 or other credential access techniques targeting Azure Arc service principal tokens.
Detects attempts by non-Azure Arc agent processes to access '.key' files within the Azure Arc Tokens directory. This activity could indicate an attempt to exploit CVE-2026-26117 or other credential access techniques targeting Azure Arc service principal tokens.
Detects unusual processes accessing the RDP Terminal Server Client Cache folder, indicating potential reconnaissance or staging for exfiltration. Attackers target this cache to exfiltrate and reconstruct image fragments of past remote sessions.
Detects unusual processes accessing the RDP Terminal Server Client Cache folder, indicating potential reconnaissance or staging for exfiltration. Attackers target this cache to exfiltrate and reconstruct image fragments of past remote sessions.
This rule detects processes attempting to access web browser credential files (e.g., 'Login Data', 'Web Data') within the AppData directory. This activity is often associated with credential dumping techniques used by adversaries to steal stored browser credentials.
Detects instances where 'notepad.exe' is executed from the 'Microsoft.WindowsNotepad' directory within 'Program Files\WindowsApps' and attempts to open a markdown (.md) file. This could indicate unusual activity or potential abuse of the Notepad application, especially if the version is not '11.2510'.
Page 68 of 76