Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects a Node.js process accessing sensitive files such as environment configuration files (.env) or browser credential/session stores. This behavior was observed in a developer-targeting campaign where attackers exfiltrated secrets from compromised developer machines.
Detects DKnife text markers and config file names referenced by Cisco Talos (dkimsi tag, default IMSI, credential tag, and common DKnife config artefact names).
The rule detects object access events (Event ID 4663) targeting files within the \Windows\System32\AppLocker directory. This identifies unauthorized attempts to read, write, or delete the system's application control policy cache, a behavior indicative of an attempt to tamper with endpoint security defenses.
Detects when a Visual Studio Code process (Code.exe) or its underlying Node.js process accesses sensitive user directories or files. This could indicate the exploitation of a vulnerable extension, such as in CVE-2025-65717, to steal credentials or other sensitive data.
Detects access to VMware virtual disk files (.vmdk). This technique was
observed being used by the Muddled Libra (Scattered Spider) threat group,
where they would power down Domain Controllers, mount their disks to a rogue
VM, and steal the NTDS.dit and SYSTEM hives for offline credential extraction.
This method bypasses security monitoring that would typically occur on the
Domain Controller itself.
observed being used by the Muddled Libra (Scattered Spider) threat group,
where they would power down Domain Controllers, mount their disks to a rogue
VM, and steal the NTDS.dit and SYSTEM hives for offline credential extraction.
This method bypasses security monitoring that would typically occur on the
Domain Controller itself.
Detects file access or download activity from SharePoint or OneDrive where the user agent is PowerShell. This TTP has been associated with UNC6671 (related to ShinyHunters) for data exfiltration from SaaS applications.
Detects the loading of 'log.dll' by 'BluetoothService.exe' or 'GUP.exe' from non-standard directories, a technique associated with the Chrysalis backdoor used in the Notepad++ supply chain attack.
Detects processes other than known Microsoft identity components accessing sensitive authentication token directories (IdentityCache or OneAuth). Threat actors use this technique to steal session tokens to bypass MFA and maintain persistent access to cloud environments.
Detects file access or download operations from Microsoft SharePoint Online where the User-Agent string indicates the use of PowerShell. This behavior has been observed in campaigns by threat groups for bulk data exfiltration.
Detects when a web browser or the Dropbox client accesses a file that is potentially sensitive, based on file name or security labels. This may indicate unauthorized data exfiltration of HBI (Highly Business-Impact) data to a personal or public Dropbox account.
Detects a process reading a .env file, which often contains sensitive credentials like API keys. This is often the first step of a data exfiltration pattern where the credentials are then sent to an attacker-controlled server. This behavior was observed in the malicious 'rankaj' OpenClaw skill. This rule should be correlated with subsequent network activity from the same process to a rare destination.
Detects attempts to access the sensitive Clawdbot/Moltbot configuration file (clawdbot.json or moltbot.json). This file contains API keys and gateway tokens. Unauthorized access, often resulting from prompt injection attacks, can lead to full agent and system compromise.
Detects access to hidden or decoy network shares that are not used by legitimate processes. This activity is indicative of network reconnaissance and lateral movement attempts. Walkthrough of Canary Shares can be found here: https://github.com/fluffybunnies-h4x/CyberDeception/blob/main/README.md#canary-shares
Detects unauthorized access to decoy files (canary files) placed in strategic locations. By monitoring for access to files with enticing names (e.g., 'passwords.xlsx'), organizations can identify file discovery and data staging activities. Any access to these files is highly suspicious as they have no legitimate purpose. Walkthrough for the creation of Canary Files can be found here: https://github.com/fluffybunnies-h4x/CyberDeception?tab=readme-ov-file#canary-files
This rule detects suspicious activity related to browser credential theft or staging. It triggers when a non-browser process accesses sensitive browser files (like 'Login Data' or 'Local State') or when temporary artifacts associated with credential stealer activity ('chromeTmp', 'Local State-journal') are created. This behavior is indicative of an attacker attempting to exfiltrate browser-stored credentials.
This rule detects suspicious activity related to accessing or dumping the NTDS.dit file, which contains Active Directory credential information. It looks for process creation events involving tools commonly used for NTDS.dit extraction (e.g., ntdsutil, secretsdump), file access events on NTDS.dit paths, and privilege use (SeBackupPrivilege, SeRestorePrivilege, SeDebugPrivilege) often associated with credential dumping.
This rule detects the XenoRAT info stealer and Remote Access Trojan (RAT) by identifying specific strings related to its functionalities. It looks for configuration parameters like 'HostName', 'PortNumber', 'UserName', and 'Password' which are typically supplied at runtime for C2 communication. The rule also identifies strings associated with browser data exfiltration ('Local Extension Settings', 'Sync Extension Settings', 'chromium_plugins', 'logins.json', 'profiles.ini', 'IndexedDB', 'chrome-extension_'), crypto wallet theft ('ChainingModeGCM'), file grabbing capabilities ('%DRIVE_FIXED%', '%DRIVE_REMOVABLE%', 'File Grabber'), and HVNC-style desktop control ('Chrome_WidgetWinOperaWindowClass', 'CreateDesktopA', 'OpenDesktopA'). Additionally, it includes specific hashes of known XenoRAT samples for direct identification.
Detects suspicious process access to common credential storage locations such as certificate stores, PCPKSP keys, and CloudAPCache for AzureAD credentials. The severity of the alert is escalated based on the initiating process and command line arguments, specifically looking for keywords like 'mimikatz', 'dump', or 'export'.
This rule detects when known code scanning tools like Trufflehog, Gitleaks, or Gittyleaks attempt to read the AWS credentials file. This activity could indicate an adversary or an internal security tool searching for sensitive AWS access keys and tokens.
Detects installed Next.js versions < 16.0.7 vulnerable to CVE-2025-55182 (React Flight RCE)
Detects access to Chrome profile data and Login Data database associated with credential theft activities linked to FlexibleFerret malware on macOS.
Page 70 of 76