Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
956 detections
Filters
Last updated
All Time
Detection languages
486
122
65
63
57
Contributors
328
210
131
82
29
Categories
504
436
202
184
173
Platforms
748
270
203
29
24
Products / Services
318
197
48
42
42
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
956
CVEs
4
3
2
2
2
IDS Classtypes
6
6
4
3
IDS Protocols
15
4
Detects the node.exe process (npm lifecycle) accessing sensitive web browser credential databases (e.g., Login Data, Cookies, Web Data, and Firefox profiles). This activity is indicative of infostealer malware, such as Miasma or MYRA, which often leverages malicious npm packages to drop and execute SQLite-based credential exfiltration logic directly from disk.
This rule detects a suspicious volume of file copy activity (over 200 files) to a non-local drive (potentially a removable/USB device) occurring within 24 hours of an account being deleted or disabled on the same host. This pattern may indicate an insider threat or an adversary attempting to exfiltrate sensitive data shortly before or after losing authorized access to an account.
Detects unauthorized access to sensitive credential files (Docker, AWS, npm, PyPI, GCloud) by Node.js processes, specifically when those processes are triggered by common npm lifecycle scripts like preinstall, postinstall, or peer dependency scripts. This is a common pattern observed in supply chain attacks involving malicious npm packages.
Detects instances where node.js or npm processes access multiple sensitive configuration or credential files (such as .aws/credentials, .npmrc, .pypirc, .gitconfig, or docker configs) and subsequently perform DNS queries against known malicious or suspicious C2 domains.
This rule detects unauthorized attempts to create, modify, rename, or delete sensitive browser data files (such as Login Data, Cookies, key4.db, and logins.json) used for storing credentials. It monitors for access by processes that are not known browser executables or authorized system services, which is a common indicator of credential dumping by malicious software.
Detects when the node.js runtime process accesses Docker configuration files, which may contain sensitive authentication credentials or registry settings. This behavior is atypical for standard node.js applications and could indicate credential theft or unauthorized container environment interaction.
Detects Node.js runtime instances interacting with multiple sensitive developer configuration and credential files (e.g., .gitconfig, GitHub CLI host tokens, Claude configuration, git-credentials) in a single session. This pattern is consistent with infostealer malware (such as Miasma/MYRA) attempting to harvest developer credentials for downstream exploitation.
This rule detects unauthorized attempts by non-browser processes to access sensitive browser-related files (Login Data, Cookies, Web Data, etc.) or interact with browser processes to extract secrets. It monitors for Sysmon Event IDs 10 (ProcessAccess), 11 (FileCreate), 7 (ImageLoad), and 1 (ProcessCreate) where a suspicious process (often located in temporary or user profile directories) attempts to read or interact with known browser credential storage paths.
Detects high-volume, rapid outbound network requests from Opera or Opera GX browser processes, characteristic of CSS attribute-selector trigram enumeration used in XS-Leak attacks to exfiltrate sensitive information from loaded web pages.
This rule monitors process command lines and file activity for keywords associated with potential reconnaissance, error logs, or debugging artifacts often used during post-exploitation or system profiling. It flags commands or files containing terms like 'memory dump', 'stack trace', 'SQL injection', or 'Redis failure', which may indicate an attacker analyzing system information or attempting to interact with backend services.
Detects processes accessing sensitive files on a Linux system, such as SSH private keys, shell history files, and various application-specific configuration or credential files (e.g., Claude, Codex, Gemini, Cline, Opencode, Kilo). The rule excludes common system processes like shells, SSH daemons, git, and curl to minimize noise while identifying suspicious file access.
Detects Python or Node.js processes accessing files associated with cryptocurrency wallets and browser extension storage. This behavior is indicative of credential or wallet theft, as observed in campaigns such as 'Contagious Interview' which involved threats like BeaverTail and InvisibleFerret.
Detects Meow RAT (ClickFix campaign) copying Chromium browser extension data directories associated with cryptocurrency wallets, including MetaMask (nkbihfbeogaeaoehlefnkodbefgpgknn), via osascript on macOS.
This rule detects potential data staging activities by monitoring for specific file paths and filenames associated with unauthorized collection of sensitive data (such as VPN configs, password databases, and office documents). It triggers when processes not typically associated with these file types access or interact with sensitive directories and file extensions.
Detects the creation of specific file paths or ZIP archives in the user profile indicative of the GIFTEDCROOK information stealer staging collected data for exfiltration.
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Ransomware group exploiting edge devices and managed file transfer software
Detects instances where a Node.js process accesses, creates, or modifies sensitive files such as SSH private keys, AWS credentials, or application configuration files (.npmrc, .pypirc, .docker/config.json). This behavior is often indicative of credential theft or unauthorized configuration access by a compromised Node.js application.
Detects node.exe accessing Chrome browser extension storage directories associated with popular cryptocurrency wallets. This activity is indicative of the Miasma/MYRA infostealer (peer-math.js) attempting to harvest encrypted wallet vaults from developer workstations, as seen in the Polymarket Trap supply chain attack.
This rule detects when processes other than standard web browsers (Chrome, Edge, Firefox, Brave, Opera) attempt to read sensitive browser data files such as 'Login Data', 'Cookies', or 'Web Data'. These files contain stored credentials and session information, and unauthorized access is a common technique used by credential-stealing malware to exfiltrate sensitive user information.
This rule detects when a Node.js or NPM process accesses multiple sensitive browser credential files (Login Data or Cookies) within a short window, while simultaneously reading shell history files (bash_history, zsh_history, or fish_history). This behavior is characteristic of an automated credential harvester or infostealer script executing within a Node.js environment.
Page 28 of 46