Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
956 detections
Filters
Last updated
All Time
Detection languages
486
122
65
63
57
Contributors
328
210
131
82
29
Categories
504
436
202
184
173
Platforms
748
270
203
29
24
Products / Services
318
197
48
42
42
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
956
CVEs
4
3
2
2
2
IDS Classtypes
6
6
4
3
IDS Protocols
15
4
Detects high-confidence BoryptGrab-lineage infostealer activity involving fake GitHub delivery indicators, known C2 infrastructure, suspicious gup.exe execution, libcurl.dll side-loading from user-writable paths, and known malicious file hashes.
Detects suspicious activities associated with browser profile hijacking. It flags the use of Robocopy to mirror browser user data directories (potentially to steal session cookies) and the subsequent launch of a web browser (Chrome/Edge) with security-disabling flags such as --no-sandbox and --disable-features=RendererCodeIntegrity, which are commonly used to bypass security features and access protected browser data.
This KQL detects activity associated with network traffic to known C2 infrastructure (45.146.252.17), suspicious Node/NPM execution chains and dropped payload/marker files. Also looks for indicators of remote control, clipboard access, screenshot/desktop-control packages, Socket.IO C2 traffic, and file/browser/wallet data exfiltration behavior.
Detects unauthorized file access attempts targeting sensitive data directories such as Telegram tdata, web browser credential stores (Login Data, Cookies), cryptocurrency wallet configuration folders (Exodus, Electrum), and Foxmail data files. This rule filters out legitimate access by the corresponding applications themselves to reduce noise.
Detects the use of command-line tools employing recursive search patterns (e.g., -Recurse) targeting document file extensions (PDF, DOCX, XLSX). This activity is often associated with the staging phase of an exfiltration attempt, where an adversary identifies sensitive files across a directory structure before collection.
Detects instances where the Node.js runtime environment (node.exe) accesses sensitive configuration, settings, or message control protocol (mcp) files within directories associated with common developer IDEs and text editors like Claude, Cursor, Windsurf, Zed, and VS Code. This activity may indicate an attempt to exfiltrate IDE configuration, API keys, or environment settings.
Detects the use of command-line tools employing recursive search patterns (e.g., -Recurse) targeting document file extensions (PDF, DOCX, XLSX). This activity is often associated with the staging phase of an exfiltration attempt, where an adversary identifies sensitive files across a directory structure before collection.
Detects NirSoft-based credential harvesting toolkit binaries staged in user profile path csidl_profile\music\mimik\pass\, used to extract browser, VNC, email, Wi-Fi, and Credential Manager secrets
Detects the creation of specific sensitive file names (AGENTS.md, MEMORY.md, IDENTITY.md, USER.md, SOUL.md) within 30 minutes of a process execution containing email-related keywords (email, mail, inbox). This pattern is often indicative of an adversary staging sensitive information for exfiltration after gaining access to or interacting with an email client or communication tool.
Detects processes attempting to read sensitive browser storage files, specifically 'Login Data' (passwords) and 'Cookies', located within common browser paths for Chrome, Firefox, and Safari on macOS or similar environments using Application Support/Library folders.
Detects file access events targeting sensitive browser files, specifically 'passwords.json' and 'cookies.json', located within the standard Chrome/browser application data directories. These files often contain stored credentials and session cookies, and unauthorized access is a common precursor to credential theft.
Detects unauthorized access attempts to session files and account credentials stored locally by Discord, Telegram, and Steam applications, a behavior consistent with the CastleStealer malware.
Detects execution of the process named nvidia-sysruntime.exe, which is identified as a malicious component associated with LabubaRAT. The rule monitors for file system events triggered by this specific binary, which is masquerading as a legitimate NVIDIA component.
Detects a sequence of file write operations followed by file read operations on specific files named 'AGENTS.md', 'MEMORY.md', 'IDENTITY.md', 'USER.md', or 'SOUL.md' with a significant time gap between the operations. This pattern is indicative of data staging, where an adversary writes sensitive information to a file and subsequently reads it for exfiltration.
Detects potential discovery of sensitive information (secrets) within container images by monitoring for the usage of 'dive' targeting private Azure Container Registry images or the use of 'docker inspect' to extract 'Config.Env' combined with 'grep' for the term 'secret'. This activity is often associated with reconnaissance for credential harvesting in containerized environments.
Detects the Cursor IDE (Cursor.exe) or its child processes accessing sensitive SSH private key files or cloud provider authentication credentials. This behavior is indicative of a compromised IDE process, potentially leveraging malicious extensions or MCP (Model Context Protocol) servers to exfiltrate secrets from the local filesystem.
This rule detects when common Windows LOLBins (Living-off-the-Land Binaries) or scripting hosts attempt to read, create, modify, or rename sensitive credential storage files (such as login databases and cookies) associated with popular web browsers like Chrome, Edge, and Firefox. Such behavior is a common indicator of credential theft activity by information-stealing malware.
Detects instances where browser-related credential files (Login Data, Cookies, cookies.sqlite) are accessed by processes that are not the associated web browsers. This behavior is indicative of credential theft or dumping, where unauthorized processes attempt to read sensitive browser data to extract stored credentials, cookies, or session tokens.
This rule monitors for the creation or modification of specific files (e.g., AGENTS.md, MEMORY.md, IDENTITY.md) that often mimic agent-based collection or configuration files. It specifically identifies when these files are created by processes associated with scheduling mechanisms like 'cron' or 'scheduler', or triggered by a 'heartbeat' event, which is potentially indicative of adversary data collection or staging activity.
This rule detects the creation of sensitive files (e.g., AGENTS.md, MEMORY.md, IDENTITY.md) on a host where there is either no corresponding chat interaction or the corresponding chat interaction lacks specific warning or security-related flags. This is intended to surface potentially unauthorized local data staging or access of system-level metadata files.
This rule detects unauthorized read, creation, modification, or renaming activity involving sensitive browser files (Login Data, Cookies, Web Data) on macOS. Adversaries often target these files to extract saved credentials, cookies for session hijacking, or browsing history.
Page 24 of 46