Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
956 detections
Filters
Last updated
All Time
Detection languages
486
122
65
63
57
Contributors
328
210
131
82
29
Categories
504
436
202
184
173
Platforms
748
270
203
29
24
Products / Services
318
197
48
42
42
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
956
CVEs
4
3
2
2
2
IDS Classtypes
6
6
4
3
IDS Protocols
15
4
Detects unauthorized processes attempting to access sensitive browser files, including Login Data (passwords) and Network/Cookies databases for Chrome, Edge, and Firefox. These files are primary targets for credential dumping and session hijacking.
Detects bulk file creation of XML files associated with Dahua credential exports, likely generated by a Python script, which is indicative of credential harvesting or staging for exfiltration.
Detects instances where the Windows command shell (cmd.exe) creates, modifies, or renames specific suspicious files ('My_Resume.pdf', 'Documents_Details.pdf') within the 'ProgramData' directory, often associated with execution of batch files or file copy operations that may indicate staging of malicious payloads.
Detects file creation events involving the 'SmartUploader' configuration file or process execution events referencing the tool, which may indicate unauthorized data collection or staging activity.
Detects the creation of specific file paths and files associated with the PSNATCH file stealer tool, specifically monitoring for the presence of SmartUploader application directories and its associated upload index files. This behavior is indicative of an adversary staging collected data on a local system for subsequent exfiltration.
Detects anomalous, high-volume file access or preview activity in OneDrive or SharePoint from non-browser user agents. This pattern is indicative of potential data exfiltration where adversaries use scripted clients or APIs to mass-read or preview files, bypassing traditional download-based alerts.
Detects automated searching (via grep, findstr, or select-string) for sensitive strings (e.g., API keys, private keys, wallet data) across multiple occurrences on a single host, or the creation of suspicious sensitive files (e.g., .env, credentials, wallet.dat) on devices where such automated sweeping activity has been observed. This pattern indicates an adversary staging data for exfiltration.
Detects access to sensitive browser credential storage files (Login Data, key4.db, logins.json) by unauthorized processes. This behavior is indicative of credential theft, where an adversary attempts to extract stored passwords from browser profiles.
Detects access to sensitive browser credential storage files (Login Data, key4.db, logins.json) by unauthorized processes. This behavior is indicative of credential theft, where an adversary attempts to extract stored passwords from browser profiles.
Detects unauthorized access, modification, or creation of the FileZilla 'sitemanager.xml' configuration file by a process other than the legitimate 'filezilla.exe'. This is a common indicator of an adversary attempting to steal stored FTP credentials or modify connection configurations.
Detects post-infection data harvesting behavior associated with PureLogs Stealer. The rule monitors specific LOLBins (.NET binaries) and suspected masqueraded payloads (e.g., syscall.exe) as they attempt to access browser credential, cookie, or web data files from Google Chrome, Microsoft Edge, and Mozilla Firefox. It also tracks the creation of these suspicious processes when invoked by scripting interpreters like PowerShell, wscript, or cscript.
Detects a single host or account interacting with a high volume of archive (PST/OST) and document files, or initiating mailbox exports within a short window, which is often indicative of mass data staging and collection prior to exfiltration.
Detects unauthorized processes (non-browser applications) creating, modifying, or renaming sensitive browser data files such as Login Data, Cookies, or local state files within standard browser profile directories. This activity is indicative of credential harvesting or session hijacking attempts by malicious software.
This rule detects the use of the macOS 'security' utility to unlock the login keychain and modify its access-control list, a technique observed in PamStealer malware to facilitate subsequent unauthorized access to the keychain database.
This rule detects the use of the macOS 'security' utility to unlock the login keychain and modify its access-control list, a technique observed in PamStealer malware to facilitate subsequent unauthorized access to the keychain database.
This rule detects the use of the macOS 'security' utility to unlock the login keychain and modify its access-control list, a technique observed in PamStealer malware to facilitate subsequent unauthorized access to the keychain database.
This rule detects the use of the macOS 'security' utility to unlock the login keychain and modify its access-control list, a technique observed in PamStealer malware to facilitate subsequent unauthorized access to the keychain database.
This rule detects the creation, modification, or renaming of files that contain sensitive keywords (e.g., 'password', 'seed', 'wallet', 'recovery') by processes other than standard system or productivity applications. This activity is indicative of credential or sensitive data harvesting.
Detects the loading of the 'WbElevation.dll' module associated with SectopRAT, followed by suspicious access to browser, email, or cryptocurrency wallet credential stores within a 10-minute window on the same device.
Detects unauthorized processes reading sensitive Chromium-based browser files (e.g., Cookies, Login Data) immediately following the termination of a browser process. This behavior is indicative of credential harvesting malware, such as RevStealer, which terminates the browser to release file locks before exfiltrating the databases.
Detects a single process accessing files across three or more distinct cryptocurrency wallet application directories within a one-hour window. This behavior is highly anomalous for legitimate applications and is characteristic of information-stealing malware, such as RevStealer, which targets stored credentials and wallet files.
Page 11 of 46