Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
956 detections
Filters
Last updated
All Time
Detection languages
486
122
65
63
57
Contributors
328
210
131
82
29
Categories
504
436
202
184
173
Platforms
748
270
203
29
24
Products / Services
318
197
48
42
42
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
956
CVEs
4
3
2
2
2
IDS Classtypes
6
6
4
3
IDS Protocols
15
4
This rule detects the creation of diagnostic crash-dump files within known engineering log directories (e.g., slog, engineermode, vendor/log) within 30 minutes of EngineerModeActivity or YLog execution. This pattern is indicative of potential forensic evidence from an induced modem crash, consistent with known exploit chains targeting specific mobile device vulnerabilities.
Detects a curl request to a tunnel-exposed /api/summary endpoint piped through jq extracting a 'spend' field, indicating automated exfiltration of financial data via a coding-agent-established tunnel.
Detects file access/modification/creation events targeting .env files or browser credential storage artifacts, combined with process command lines referencing API_KEY/TOKEN alongside environment-variable access patterns, indicative of infostealer malware harvesting developer secrets and browser-stored credentials, followed by an outbound network connection consistent with exfiltration.
This rule detects macOS infostealer activity, such as AMOS, MacSync, or SHub, by identifying suspicious, correlated access to sensitive credential stores including the macOS Keychain, web browser credential databases (Chrome), SSH keys, and cryptocurrency wallet configuration files. It uses a combination of path/command-line strings and generic indicators of credential harvesting behavior.
Detects Shai-Hulud / ChainDrop activity by correlating known malicious hashes, npm/Node/Bun execution, payload artifacts, IDE persistence, credential discovery, cloud metadata access, GitHub exfiltration, C2 domains, Ethereum RPC activity, staging files, persistence artifacts, and known IOC IP connections.
This rule detects potential credential theft activity where a process spawning a command-line interpreter (bash, sh, zsh) using 'curl' simultaneously accesses sensitive browser configuration or credential directories on MacOS, such as Chrome, Firefox, or Safari application support paths. This pattern is indicative of an adversary attempting to exfiltrate browser-stored secrets.
This rule detects suspicious activity originating from the Node.js runtime environment. It specifically monitors for 'node.exe' or 'node' processes accessing sensitive credential-related files (such as .npmrc, .netrc, .git-credentials, or id_rsa) followed closely (within 5 minutes) by network connections to public IP addresses. This behavior is indicative of an npm-based malware or malicious package attempting to harvest locally stored credentials and exfiltrate them to an external, potentially attacker-controlled server.
This rule detects unauthorized or suspicious file access, modification, or creation events targeting sensitive web browser data files, including login credentials, saved passwords, and browser cookies. These files are prime targets for information-stealing malware attempting to harvest sessions or authentication data.
This rule detects potential credential or sensitive file theft from VS Code extensions or configuration folders, followed closely by network exfiltration to the Telegram API. It specifically monitors file access to common paths (.ssh/id_rsa, .aws/credentials, .netrc, Local Storage, etc.) by VS Code processes, correlated with non-Telegram processes establishing network connections to api.telegram.org within a 10-minute window.
Detects the execution of processes related to 'SKILL.md', 'npx', 'mcp-server', or 'invoke_skill' followed closely by read or copy actions on sensitive file locations (SSH keys, AWS credentials, environment files, or AppData). The rule further correlates this activity with subsequent outbound network connections from the same device.
Detects a curl request to a tunnel-exposed /api/summary endpoint piped through jq extracting a 'spend' field, indicating automated exfiltration of financial data via a coding-agent-established tunnel.
This rule detects suspicious activity originating from the Node.js runtime environment. It specifically monitors for 'node.exe' or 'node' processes accessing sensitive credential-related files (such as .npmrc, .netrc, .git-credentials, or id_rsa) followed closely (within 5 minutes) by network connections to public IP addresses. This behavior is indicative of an npm-based malware or malicious package attempting to harvest locally stored credentials and exfiltrate them to an external, potentially attacker-controlled server.
This rule detects activities associated with the SHub Stealer malware on macOS, specifically identifying the creation of staging directories in /tmp (named /tmp/shub_<id>/*), the presence of a 'FileGrabber' sub-directory, and unauthorized file access to common cryptocurrency wallet applications like Electrum, Exodus, Trezor Suite, Ledger Live, Sparrow, and Guarda. It filters out common administrative or installer tools to reduce noise.
Detects suspicious cross-process memory access or memory-dump activity targeting chrome.exe, consistent with extraction of the Security Domain Secret (SDS) master key or wrapped identity/UV private keys used to decrypt synced passkey credentials (Golden Pass-ta-key attack). Excludes known legitimate crash-dump and diagnostic tooling (WerFault, crashpad_handler, procdump, Chrome itself).
Detects the execution of processes related to 'SKILL.md', 'npx', 'mcp-server', or 'invoke_skill' followed closely by read or copy actions on sensitive file locations (SSH keys, AWS credentials, environment files, or AppData). The rule further correlates this activity with subsequent outbound network connections from the same device.
Detects NightLedger Command 93, which collects C:\Windows\debug\NetSetup.log alongside a process listing and exfiltrates both to C2. Since DeviceFileEvents does not surface read-class ActionTypes, this query hunts the collection behavior in DeviceProcessEvents: shell commands (type, more, cmd /c) referencing the NetSetup.log path, spawned from the DLL-loader process class consistent with NightLedger's execution chain. NetSetup.log contains domain name, DC hostnames, and join timestamps, high-value AD recon for an espionage actor.
Detects a non-Chrome, unsigned process reading Chrome's Sync Data LevelDB store, where encrypted WebauthnCredentialSpecifics passkey records are persisted, consistent with the collection stage of a Pass-ta-key credential-theft chain. Excludes Chrome itself, known backup/sync clients, the Windows Search indexer, and signed security/EDR tooling.
Detects suspicious cross-process memory access or memory-dump activity targeting chrome.exe, consistent with extraction of the Security Domain Secret (SDS) master key or wrapped identity/UV private keys used to decrypt synced passkey credentials (Golden Pass-ta-key attack). Excludes known legitimate crash-dump and diagnostic tooling (WerFault, crashpad_handler, procdump, Chrome itself).
Detects a non-Chrome, unsigned process reading Chrome's Sync Data LevelDB store, where encrypted WebauthnCredentialSpecifics passkey records are persisted, consistent with the collection stage of a Pass-ta-key credential-theft chain. Excludes Chrome itself, known backup/sync clients, the Windows Search indexer, and signed security/EDR tooling.
Detects a process running from a path ending in svchost32.exe performing an unusually high volume of file open/read/rename/write operations or transferring a large total byte volume within a 1-hour window, consistent with CornFlake bulk file collection/exfiltration nearing its documented throttle limits.
Detects file creation, modification, or rename activity targeting known directory paths and files used by the AMOS (Atomic macOS Stealer) to stage exfiltrated credentials, cryptocurrency wallets, and browser data. It identifies staging activity by looking for patterns associated with the stealer's data-collection routines.
Page 22 of 46