Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects a potential ToddyCat APT technique where a single source remotely accesses sensitive browser or DPAPI credential files on multiple hosts via SMB. This behavior is consistent with the group's TomBerBil PowerShell script used for widespread credential harvesting.
Detects commandline operations on shell history files
Detects system information discovery commands
Detects a sequence of file operations indicative of CLFS Base Log File (.blf) tampering, a technique used in CVE-2024-49138 exploitation. The detection looks for a process writing to a .blf file, immediately followed by a read of the same file, which is an unusual pattern as regular applications use CLFS APIs, not direct file writes.
Detects a process accessing multiple files related to known cryptocurrency wallets or browser extensions. This behavior is indicative of information stealers like LeakyStealer attempting to exfiltrate sensitive wallet data.
To detect sensitive or confidential information sent by email from our users, I discovered that DefenderXDR is registering events when some user or services is reading files tagged or marked as sensitive. Basically, it has a "SensitiveFileRead" ActionType in the DeviceFileEvents table which indicates that a process on the monitored device has accessed a file classified as sensitive. This could include files with personally identifiable information (PII), intellectual property, or other data deemed sensitive based on the organization’s data protection policies or Microsoft’s predefined rules. This event type is essential for tracking access to sensitive data, helping to identify potential data leakage or unauthorized access attempts.
Detects unauthorized access to Signal Desktop's sensitive data files, specifically 'db.sqlite' which stores encrypted messages and 'config.json' which contains the decryption key. An adversary gaining access to both files can decrypt and read sensitive messages without user credentials. The rule currently focuses on the default installation path in AppData\Roaming.
Detects calls to hidden files or files located in hidden directories in Linux systems. This rule specifically looks for file paths containing '/.' which is a common convention for hidden files and directories in Unix-like systems, while filtering out common legitimate hidden paths like '.cache' and '.config'.
Detects file access requests to files ending with either the ".hive" or ".reg" extension, which are typically associated with Windows Registry backups. The rule specifically looks for these accesses by applications not located in common system directories (C:\Program Files (x86)\, C:\Program Files\, C:\Windows\System32\, C:\Windows\SysWOW64\), indicating potentially suspicious activity by uncommon or unauthorized applications.
Detects PowerShell execution patterns associated with the "Cache Smuggling" technique. This involves copying browser cache files, searching them with regex for an embedded payload, and then writing and executing that payload. This specific variant was observed being launched by conhost.exe in headless mode to conceal the window.
Detects a process accessing multiple sensitive files in WhatsApp or Google Chrome data folders, a technique used by Mysterious Elephant APT's exfiltration tools (Uplo, Stom, ChromeStealer).
Detects access to known sensitive file extensions on network shares. This can indicate an adversary attempting to collect sensitive data such as backups, memory dumps, Kerberos tickets, or various email/messaging data files.
The following analytic detects suspicious attempts to find SSH private keys, which may indicate an attacker's effort to compromise secure access to systems. SSH private keys are essential for secure authentication, and unauthorized access to these keys can enable attackers to gain unauthorized access to servers and other critical infrastructure. By monitoring for unusual or unauthorized searches for SSH private keys, this analytic helps identify potential threats to network security, allowing security teams to quickly respond and safeguard against unauthorized access and potential breaches.
This rule detects suspicious access to files with sensitive extensions commonly associated with email archives, database files, memory dumps, and remote desktop connection files. Monitoring access to these file types can indicate attempts at data collection, credential dumping, or lateral movement preparation by adversaries.
Detects access to Signal Desktop's sensitive data files: db.sqlite and config.json.
The db.sqlite file in Signal Desktop stores all locally saved messages in an encrypted SQLite database, while the config.json contains the decryption key needed to access that data.
Since the key is stored in plain text, a threat actor who gains access to both files can decrypt and read sensitive messages without needing the users credentials.
Currently the rule only covers the default Signal installation path in AppData\Roaming. Signal Portable installations may use different paths based on user configuration. Additional paths can be added to the selection as needed.
The db.sqlite file in Signal Desktop stores all locally saved messages in an encrypted SQLite database, while the config.json contains the decryption key needed to access that data.
Since the key is stored in plain text, a threat actor who gains access to both files can decrypt and read sensitive messages without needing the users credentials.
Currently the rule only covers the default Signal installation path in AppData\Roaming. Signal Portable installations may use different paths based on user configuration. Additional paths can be added to the selection as needed.
The following analytic detects a non-Chrome process accessing files in the Chrome user default folder. It leverages Windows Security Event logs, specifically event code 4663, to identify unauthorized access attempts. This activity is significant because the Chrome default folder contains sensitive user data such as login credentials, browsing history, and cookies. If confirmed malicious, this behavior could indicate an attempt to exfiltrate sensitive information, often associated with RATs, trojans, and advanced persistent threats like FIN7. Such access could lead to data theft and further compromise of the affected system.
Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.
This rule detects when processes other than Firefox or Windows Explorer attempt to access the Firefox profile directory. This directory contains sensitive user data like login credentials, browsing history, and cookies. Such activity, monitored via Windows Security Event 4663, could indicate malware (e.g., RATs, trojans) trying to harvest user information, potentially leading to data exfiltration, unauthorized account access, and system compromise.
The following analytic detects non-Chrome processes accessing the Chrome "Local State" file, which contains critical settings and information. It leverages Windows Security Event logs, specifically event code 4663, to identify this behavior. This activity is significant because threat actors can exploit this file to extract the encrypted master key used for decrypting saved passwords in Chrome. If confirmed malicious, this could lead to unauthorized access to sensitive information, posing a severe security risk. Monitoring this anomaly helps identify potential threats and safeguard browser-stored data.
This analytic identifies non-Chrome processes accessing the Chrome user data file "Login Data." This file is an SQLite database containing sensitive information, including saved passwords. The detection leverages Windows Security Event logs, specifically event code 4663, to monitor access attempts. This activity is significant as it may indicate attempts by threat actors to extract and decrypt stored passwords, posing a risk to user credentials. If confirmed malicious, attackers could gain unauthorized access to sensitive accounts and escalate their privileges within the environment.
Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale
Page 71 of 76