Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
956 detections
Filters
Last updated
All Time
Detection languages
486
122
65
63
57
Contributors
328
210
131
82
29
Categories
504
436
202
184
173
Platforms
748
270
203
29
24
Products / Services
318
197
48
42
42
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
956
CVEs
4
3
2
2
2
IDS Classtypes
6
6
4
3
IDS Protocols
15
4
Detects unauthorized access to sensitive credential and configuration files associated with AI development tools (Cursor, Claude, Gemini) and cloud providers (AWS, GCP) by the Miasma worm, which seeks to steal environment configuration and authentication data.
This rule detects potential credential harvesting activity associated with the Hannibal Stealer. It looks for non-standard processes (processes other than the browsers themselves) that access sensitive browser credential stores (like 'Login Data', 'cookies.sqlite', or 'key4.db') and correlate these file access events with the loading of 'bcrypt.dll' or 'CefSharp.BrowsersSubprocess.dll', which are often used for decryption or browser automation/sub-processes during credential theft.
Detects unauthorized access to Chrome and Firefox browser credential (Login Data, logins.json, key4.db) and cookie database files on macOS by non-browser processes, commonly observed in credential theft campaigns like ClickFix.
This rule detects suspicious file read or access events on common cryptocurrency wallet application folders (Electrum, Coinbase, Exodus), specific wallet files (wallet.dat), or browser extension folders associated with MetaMask. The rule specifically excludes legitimate access by the wallet applications themselves or common browsers to reduce false positives, indicating that an unauthorized process might be attempting to access sensitive cryptocurrency data.
Detects the use of 'docker cp' to copy files to or from sensitive host paths, such as cron, password files, SSH keys, or system directories, which often indicates attempts to escape container isolation or establish persistence on the host.
This rule detects non-browser processes attempting to access sensitive local files associated with common web browsers (Google Chrome, Microsoft Edge, and Mozilla Firefox). Specifically, it monitors for file events involving login databases, cookies, and key storage files by processes other than legitimate browser executables, which is a common technique used by credential-stealing malware.
This rule detects processes other than standard browsers (Chrome, Edge, Firefox, Opera) or authorized password managers (KeePass) accessing sensitive files such as browser credential stores, cookies, local state configuration files, KeePass databases (.kdbx), or VPN configuration files (.ovpn). The rule identifies suspicious activity by monitoring for access patterns that indicate potential credential theft or exfiltration.
Detects file creation events associated with the UAC-0226 campaign, specifically targeting Ukrainian military-themed lures and staging artifacts related to the GIFTEDCROOK malware. This rule monitors for the presence of specific file paths and naming conventions indicative of ongoing espionage operations.
Detects the use of osql.exe or sqlcmd.exe to query database schema information (such as sys.objects, sys.tables, or INFORMATION_SCHEMA) with output redirected to a file. This behavior is flagged when launched from non-standard parent processes, specifically those commonly associated with web shell activity like w3wp.exe, suggesting post-exploitation database discovery.
Detects instances where non-browser processes (that are not signed by major browser vendors) attempt to access common browser credential files such as 'Login Data' or 'logins.json'. This behavior is characteristic of credential dumping or exfiltration attempts by malicious software trying to steal stored browser passwords.
Detects potential financial data exfiltration by monitoring for bulk downloads of files with financial keywords from SaaS/Office365 platforms, and identifies unauthorized processes attempting to access sensitive financial application data files (.qbw, .qbb, etc.) on local systems.
Detects unauthorized access, modification, or deletion attempts against common web browser credential storage files (key4.db, logins.json, and Microsoft Edge 'Login Data'). These files store sensitive authentication information, and non-browser processes interacting with them are indicative of credential harvesting attempts.
Detects the execution of command-line archiving utilities (7z, rar, tar) invoked by common scripting engines (PowerShell, CMD, Python, etc.) targeting typical staging directories (Temp, Public, AppData, ProgramData). This pattern is frequently observed during the data staging phase of an attack, where adversaries encrypt or compress gathered files for eventual exfiltration.
Detects unauthorized access, modification, or deletion attempts against common web browser credential storage files (key4.db, logins.json, and Microsoft Edge 'Login Data'). These files store sensitive authentication information, and non-browser processes interacting with them are indicative of credential harvesting attempts.
Detects instances where processes other than legitimate browser components attempt to access, read, or copy the browser 'Login Data' file. This file stores credentials used by Google Chrome and Microsoft Edge, and unauthorized access is a common technique used by credential-stealing malware.
Detects instances where processes other than legitimate browser components attempt to access, read, or copy the browser 'Login Data' file. This file stores credentials used by Google Chrome and Microsoft Edge, and unauthorized access is a common technique used by credential-stealing malware.
Detects node.exe copying browser history files to temporary directories, associated with the protocal.cjs backdoor.
This rule detects when the Internet Information Services (IIS) worker process (w3wp.exe) accesses sensitive files such as 'web.config', 'applicationHost.config', or 'win.ini'. Unauthorized access to these files by the IIS process can be an indicator of a web shell or other malicious post-exploitation activity attempting to steal credentials, application secrets, or system configuration information.
This rule monitors process command lines and file activity for keywords associated with potential reconnaissance, error logs, or debugging artifacts often used during post-exploitation or system profiling. It flags commands or files containing terms like 'memory dump', 'stack trace', 'SQL injection', or 'Redis failure', which may indicate an attacker analyzing system information or attempting to interact with backend services.
Detects unauthorized processes attempting to read, modify, or create files within common browser credential locations (Chrome, Firefox, Edge, and Windows Credential Manager). Legitimate browser processes and their known signers are excluded, focusing on suspicious secondary processes or tools frequently utilized by infostealers like Lumma and RedLine to dump credentials.
Detects unauthorized access or modification to common CI/CD credential files (.npmrc, .pypirc, .git-credentials, jenkins credentials.xml) and CI/CD configuration files (.github/workflows, .gitlab-ci.yml). The rule monitors both file system activities by non-standard processes and the execution of command-line tools that reference these sensitive files.
Page 32 of 46