Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
956 detections
Filters
Last updated
All Time
Detection languages
486
122
65
63
57
Contributors
328
210
131
82
29
Categories
504
436
202
184
173
Platforms
748
270
203
29
24
Products / Services
318
197
48
42
42
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
956
CVEs
4
3
2
2
2
IDS Classtypes
6
6
4
3
IDS Protocols
15
4
Detects potentially malicious activity involving MySQL processes, specifically focusing on the creation of files within the /var/lib/mysql-files/ directory, use of SQL 'INTO OUTFILE' for file output, or the use of 'LOAD_FILE()' to read sensitive system files like /etc/hostname or /proc/1/mountinfo, often indicative of SQL injection exploitation or unauthorized data access.
Detects instances where a shell interpreter (bash or sh) accesses sensitive cloud and environment configuration files, specifically when initiated by parent processes associated with IDE-integrated development tools or AI assistants (claude, cursor, copilot-cli). This behavior suggests potential unauthorized access to credentials or environment variables.
Detects a process creating SQLite-style database files with random hex-like names within a randomly named subfolder of the Windows %TEMP% directory. This behavior, when correlated with file system access to specific cryptocurrency wallet directories (Electrum, Exodus, Ethereum, Coinomi), is consistent with Vidar information stealer staging activity.
Detects activity associated with the 'MiniBrowse.exe' process, which exhibits behaviors characteristic of unauthorized browser credential and cookie harvesting. This includes targeting browser 'Login Data' files, accessing cookies, attempting to interact with legitimate browser processes (chrome.exe, msedge.exe) via cross-process operations, and writing logs to 'edgeLog.txt'.
This rule detects an unusually high volume of object close operations (Event ID 4658) by a single user on a single computer within a one-hour window. This activity could indicate various malicious behaviors, including data collection for exfiltration, attempts to delete numerous files, or resource exhaustion attacks.
Detects the creation or modification of known malicious files associated with the StegoAd (DarkSpectre) campaign. The rule monitors popular Chromium-based browsers (Chrome, Edge, Brave) dropping specific files like 'msn.woff' (malicious font), WebP containers (steganography), and 'setting.conf' (C2 configuration) into browser-related directories such as AppData or extension storage folders.
Detects node.exe accessing sensitive SSH configuration and key files (id_rsa, id_ed25519, id_ecdsa, known_hosts, authorized_keys) within the user's .ssh directory. This behavior is associated with the Miasma and MYRA infostealers identified in the Polymarket Trap npm supply chain attack campaign, which exfiltrate developer credentials.
This rule detects a suspicious volume of file copy activity (over 200 files) to a non-local drive (potentially a removable/USB device) occurring within 24 hours of an account being deleted or disabled on the same host. This pattern may indicate an insider threat or an adversary attempting to exfiltrate sensitive data shortly before or after losing authorized access to an account.
Detects suspicious file creation activities by system authentication processes (e.g., sshd, su, sudo, PAM) in known staging directories (/tmp, /var/tmp, /dev/shm) or SSH configuration paths. The rule looks for hidden files or files with specific extensions (.log, .dat, .bak) often associated with malicious backdoored components used to intercept and store credentials in plaintext.
This rule detects unauthorized attempts to create, modify, rename, or delete sensitive browser data files (such as Login Data, Cookies, key4.db, and logins.json) used for storing credentials. It monitors for access by processes that are not known browser executables or authorized system services, which is a common indicator of credential dumping by malicious software.
Detects unauthorized processes attempting to read, modify, create, or rename browser sensitive data files such as 'Login Data' (passwords) and 'Cookies' for Google Chrome and Microsoft Edge. This activity is a common indicator of credential theft or session hijacking.
Detects instances where Chrome or Microsoft Edge web browsers access local sensitive credential storage files (e.g., Login Data, Web Data, Cookies) from unexpected file system paths, combined with external network traffic from the same process instance. This behavior is indicative of potential malicious browser extension abuse, DLL sideloading, or unauthorized browser instance execution for credential exfiltration.
This rule detects unauthorized access attempts to common cryptocurrency wallet data files and Telegram Desktop session information, a pattern of behavior consistent with the data collection phase of the Vidar information stealer.
Detects unauthorized processes, such as PyInstaller binaries or Python scripts, attempting to read LevelDB storage files used by popular messaging applications (Discord, Telegram, Signal, Slack, and Microsoft Teams) for session and authentication token extraction, a technique commonly associated with information stealers like Yuta or Glove Stealer.
Detects Node.js processes accessing sensitive configuration and credential files such as AWS credentials, .npmrc tokens, SSH keys, and Docker configurations. This behavior is consistent with infostealer activity, including malicious supply chain attacks designed to harvest developer secrets from local filesystems.
This rule detects potential exfiltration attempts from a GCP Cloud Run container by monitoring for outbound network connections triggered by processes reading sensitive local files. The files being monitored include environment variable configurations (/proc/self/environ) and application source code, which may contain credentials or service account tokens.
Detects anomalous Python activity indicative of the InvisibleFerret backdoor, specifically focusing on instances where Python processes are spawned by developer tools (node.exe, code.exe, cursor.exe), access sensitive credential/wallet files, or initiate outbound network connections on common C2 ports.
Detects unauthorized access to sensitive developer artifacts, including Git credentials, GitHub CLI configurations, GitHub Desktop logs, and VS Code global storage files by suspicious processes (Node.js, Python, or VS Code executables) commonly leveraged in the 'Contagious Interview' campaign associated with the Lazarus Group for credential theft.
This rule detects node.js processes, typically initiated via npm or during package installation scripts, accessing sensitive Claude Code configuration or credential files. This behavior is indicative of a malicious supply chain attack where a compromised npm package attempts to exfiltrate developer authentication secrets.
Campaign converting compromised FortiGate firewalls into credential stealers
This rule monitors for Node.js processes accessing sensitive configuration files, environment files, or credential stores (such as AWS credentials). It also triggers when command line arguments or file contents contain patterns indicative of infostealer activity, including specific indicators related to the Polymarket campaign or credentials collection functions like Git or Docker credential harvesting.
Page 26 of 46