Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
956 detections
Filters
Last updated
All Time
Detection languages
486
122
65
63
57
Contributors
328
210
131
82
29
Categories
504
436
202
184
173
Platforms
748
270
203
29
24
Products / Services
318
197
48
42
42
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
956
CVEs
4
3
2
2
2
IDS Classtypes
6
6
4
3
IDS Protocols
15
4
Detects the EKZ Stealer malware (masquerading as 'FortiEndpoint_Patch.exe') attempting to access sensitive web browser files ('Login Data' and 'Local State') used to store credentials, and subsequently writing stolen information to 'C:\ProgramData\log.txt'.
Detects unauthorized access, copy, or read operations against Chromium-based browser cookie database files by processes other than standard browsers. This behavior is indicative of session hijacking, a technique observed in malware like TONResolver and Millenium RAT to extract authentication tokens for subsequent adversary-in-the-middle or session theft attacks.
Detects the execution of 7-Zip (7z.exe) when launched from a specific directory path ('Traiolx Custom Utils') while operating on specific files named 'drata.dat' or 'data.dat'. This behavior is indicative of an adversary staging or archiving sensitive data for potential exfiltration.
Detects instances where the 'pg_dump' database utility is executed, followed by the deletion of a file within a one-hour window by the same agent. This behavior is indicative of an attacker extracting sensitive database contents and subsequently attempting to remove evidence of the dump or staging files.
Detects unauthorized processes (Node.js or Python) attempting to read sensitive browser credential files or access browser profile directories, often indicative of credential theft malware such as BeaverTail or InvisibleFerret.
Detects potential data exfiltration by monitoring interpreter processes (Python, Node.js) that access sensitive local credential/configuration files and subsequently connect to known cloud storage or code repository APIs (Dropbox, GitHub, Google Cloud). The rule correlates file access events with network connection activity.
Detects instances where scripting engines (Python or Node.js) access known SSH private key files and subsequently initiate a successful network connection to a non-private IP address within a 60-second window. This behavior is indicative of potential credential exfiltration or unauthorized remote access.
Detects Node.js, NPM, or NPX processes attempting to read sensitive shell history files (e.g., .bash_history, .zsh_history). This behavior is characteristic of malicious activity such as infostealers attempting to harvest credentials or reconnaissance data from a compromised developer environment, notably observed in supply chain campaigns like the Polymarket Trap.
Detects non-browser processes attempting to read or delete sensitive browser data files (e.g., Login Data, Cookies, Web Data, logins.json, cookies.sqlite) located in standard Windows browser paths. The rule specifically flags suspicious behavior involving file access and deletion patterns commonly associated with credential theft or 'browser-wiping' malware like Remcos.
Detects indicators associated with the 'smart_window' campaign targeting Firefox, which attempts to exfiltrate browser history and page content via unauthorized registry modifications, malicious file artifacts, and specific network communication patterns to localhost or external URLs.
This rule detects the execution of a process named 'sightgrab.exe' or the creation of suspicious JPG files within the 'C:\Users\Public\Videos\' directory. This activity is indicative of credential or data harvesting tools, often used to capture screenshots or sensitive user data, followed by staging the captured files in public-accessible folders.
Detects bulk file access or modifications in sensitive directories (Desktop, Documents, Downloads) targeting credential and document files (ovpn, kdbx, jks, eml, docx, xlsx, pdf), or direct PowerShell access to OpenVPN configuration or KeePass database files. This behavior is indicative of data staging or exfiltration activities associated with the GIFTEDCROOK stealer.
Detects anomalous or unauthorized processes accessing sensitive AI configuration files, SSH configurations, version control files, and shell history within a short time window. The rule flags instances where non-standard or unexpected applications exhibit broad or high-frequency access to these files, which are common targets for credential harvesting or exfiltration by adversaries.
This rule detects suspicious activities originating from Python processes spawned by development tools like VS Code, Node.js, or npm. It flags potential credential access when such processes attempt to read sensitive files (e.g., browser profiles, SSH keys, cloud configuration files) or perform suspicious network communication to external, non-standard ports, which may indicate data exfiltration or command-and-control behavior.
Detects access to 'wallet.dat' files (commonly associated with cryptocurrency wallets) by processes with misleading or suspicious names running from user AppData directories. This behavior is indicative of credential theft or malware attempting to exfiltrate digital assets.
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Ransomware group exploiting edge devices and managed file transfer software
Detects instances where 'node.exe' is observed copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories. This activity is indicative of data staging or exfiltration, specifically linked to the 'protocal.cjs' backdoor from the 'easy-day-js' supply chain attack.
This rule monitors for a combination of suspicious behaviors including C2 network activity to known malicious IPs, potential credential theft targeting browser data files, suspicious library loading (such as keyloggers or potential sideloading) from temp or appdata directories, and beaconing activity using non-standard or suspicious processes. The rule calculates a risk score based on the number and type of indicators observed on a single host.
Detects rapid or aggregate access to multiple sensitive credential or configuration files across various applications (e.g., AWS, Docker, Kubernetes, Crypto wallets, AI tools) within a short timeframe. This behavior is indicative of credential harvesting or post-compromise reconnaissance to steal secrets and keys.
This rule detects a suspicious volume of file copy activity (over 200 files) to a non-local drive (potentially a removable/USB device) occurring within 24 hours of an account being deleted or disabled on the same host. This pattern may indicate an insider threat or an adversary attempting to exfiltrate sensitive data shortly before or after losing authorized access to an account.
Page 27 of 46