Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
955 detections
Filters
Last updated
All Time
Detection languages
486
121
65
63
57
Contributors
328
210
131
82
29
Categories
504
436
201
183
173
Platforms
747
270
203
29
24
Products / Services
318
197
48
42
42
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
955
CVEs
4
3
2
2
2
IDS Classtypes
6
6
4
3
IDS Protocols
15
4
This rule detects potential exfiltration of sensitive files, specifically 'cert.pem' and 'private.key', via HTTP POST requests to the '/api/adbk/upload' endpoint. This pattern is characteristic of the RatHat malware attempting to exfiltrate device credentials to a Command and Control (C2) server.
Detects the execution of the 'getevent' utility by a process running with the 'shell' user ID, specifically targeting Android input device nodes. This pattern is indicative of the RatHat malware's AdbTouchCapture module, which is used to monitor touch events to facilitate the unauthorized capture of PINs or pattern locks.
Detects high-volume filesystem activity (exceeding 300 operations in 5 minutes) initiated by 'claude-code' or 'claude' processes. This behavior may indicate an autonomous, patched, or jailbroken AI coding assistant performing mass file operations or reconnaissance without user confirmation.
This rule detects processes accessing or modifying Microsoft Outlook data files (.pst or .ost), which may indicate an attempt to collect, stage, or export sensitive email data from a local system.
Detects access, reading, or modification of sensitive credential files (such as KeePass databases, VPN profiles, private SSH keys, and certificates) by a process. This behavior is often associated with pre-encryption staging for data exfiltration during ransomware attacks.
Detects the creation or modification of a file named 'uploaded_files.json' within a directory containing 'SmartUploader' under the user's AppData path. This pattern is often indicative of data staging or local file tracking activity by potentially malicious software.
Detects the creation or modification of a file named 'uploaded_files.json' within a directory containing 'SmartUploader' under the user's AppData path. This pattern is often indicative of data staging or local file tracking activity by potentially malicious software.
Detects automated searching (via grep, findstr, or select-string) for sensitive strings (e.g., API keys, private keys, wallet data) across multiple occurrences on a single host, or the creation of suspicious sensitive files (e.g., .env, credentials, wallet.dat) on devices where such automated sweeping activity has been observed. This pattern indicates an adversary staging data for exfiltration.
Detects the creation of specific staging files and directories associated with the Rapuncel infostealer (e.g., UserInformation.txt, installed_applications.txt, sends.log, browser_decryption.log, or the Filegraber directory) within Windows temporary storage paths. This activity typically occurs following the unauthorized collection of sensitive data such as credentials, digital wallet information, and messenger session data.
Detects Microsoft Defender (MsMpEng) performing scan or remediation actions against non-standard filesystem paths, specifically NT object-manager namespace paths or CLFS-driver-prefixed paths. This behavior is indicative of an exploitation attempt (e.g., CVE-2026-69414) where an attacker uses symbolic links and CLFS driver namespaces to redirect the Defender scanning engine to arbitrary files on the system, potentially allowing file reads as SYSTEM.
This rule detects malicious activity associated with the Bazinga macOS backdoor, specifically focusing on the clearing of TCC privacy permissions, the staging of keychain and browser data using 'ditto', and the subsequent exfiltration of this data to a remote host via 'curl'.
Detects unauthorized access or file creation events targeting the 'tdata' directory, which stores local Telegram session and authentication data. The rule triggers when processes other than legitimate Telegram or system file explorers interact with these files, a common technique for session theft and account takeover.
Detects HTTP POST requests to a specific API endpoint (/api/adbk/upload) containing references to 'cert.pem' and 'private.key', indicating the exfiltration of sensitive cryptographic material by the RatHat malware.
Detects file creation, modification, or renaming activity within AppData directories associated with VPN clients (CyberGhost, NordVPN, ExpressVPN). This rule is intended to identify potential unauthorized access, staging, or tampering with VPN configuration files or credentials often stored in these application directories.
This rule detects behaviors associated with the Hannibal Stealer, specifically the identification of the Bitcoin Core wallet directory via registry lookups (strDataDir) followed by the unauthorized copying of 'wallet.dat' files into a staging directory structure, commonly used for cryptocurrency wallet exfiltration.
Detects modifications, creation, or renaming of common cryptocurrency wallet files (e.g., wallet.dat, .wallet files) within known storage directories. This behavior is often associated with infostealers or malware attempting to exfiltrate or manipulate user financial assets.
Detects presence of configuration markers associated with the Hannibal Stealer 'clipper' functionality. These markers (e.g., 'cclipper', 'clipboard_check_delay') are used by the malware to monitor the system clipboard and replace cryptocurrency wallet addresses with attacker-controlled addresses.
This rule detects potential information stealer activity by identifying the staging of files (.html, .txt, .log) in common user directories like AppData or Temp, combined with process command lines querying sensitive system information (e.g., BIOS, wallets, screen resolution) and network connections to the Telegram API for likely exfiltration.
Detects potential Remus infostealer activity by monitoring unauthorized processes accessing AI agent credential directories (Claude, Cursor, OpenCode, Codex) or cryptocurrency wallet files, specifically when combined with .lnk shortcut file access behavior.
Detects potential Remus infostealer activity by monitoring unauthorized processes accessing AI agent credential directories (Claude, Cursor, OpenCode, Codex) or cryptocurrency wallet files, specifically when combined with .lnk shortcut file access behavior.
Detects suspicious processes accessing cryptocurrency wallet data files or web browser extension storage folders associated with popular crypto wallets. This behavior is indicative of credential theft or wallet data exfiltration by malware targeting digital assets.
Page 12 of 46