Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
956 detections
Filters
Last updated
All Time
Detection languages
486
122
65
63
57
Contributors
328
210
131
82
29
Categories
504
436
202
184
173
Platforms
748
270
203
29
24
Products / Services
318
197
48
42
42
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
956
CVEs
4
3
2
2
2
IDS Classtypes
6
6
4
3
IDS Protocols
15
4
This rule detects web browser processes (Chrome, Edge, Brave, Electron) making network requests to 'raw.githubusercontent.com' that contain keywords indicative of sensitive data, such as 'credential', 'secret', 'password', 'token', 'api_key', or '.env'. This behavior may indicate an adversary attempting to download configuration files or sensitive credentials hosted on GitHub.
This rule detects web browser processes (Chrome, Edge, Brave, Electron) making network requests to 'raw.githubusercontent.com' that contain keywords indicative of sensitive data, such as 'credential', 'secret', 'password', 'token', 'api_key', or '.env'. This behavior may indicate an adversary attempting to download configuration files or sensitive credentials hosted on GitHub.
Detects read access to cryptocurrency wallet files and application directories (including Electrum, Exodus, Atomic, and generic wallet.dat files) by non-wallet associated processes. This behavior is consistent with credential harvesting activities by info-stealing malware such as StealC.
Detects unauthorized file access to browser extension directories and credential stores (History, Login Data) by a suspicious Node.js process named 'protocal.cjs'. This activity is characteristic of the 'easy-day-js' supply chain compromise, where a malicious backdoor attempts to exfiltrate browser-stored credentials and history from Chrome, Edge, and Brave browsers.
Detects file operations (creation, modification, deletion, renaming) involving common SSH key files (id_rsa, id_ed25519) or files located within .ssh directories, initiated by processes typically associated with AI/LLM tools (chatgpt, perplexity, etc.) or generic process names. This may indicate an attempt to exfiltrate or manipulate authentication credentials by unauthorized applications.
Detects unauthorized processes attempting to read sensitive application data directories (specifically for Telegram and Discord) on macOS. This behavior is indicative of infostealer malware, such as AMOS (Atomic macOS Stealer), attempting to exfiltrate session tokens and account information.
Detects the use of the 'ditto' command with specific arguments indicating data staging or collection activities, particularly when archiving to a temporary location like '/tmp/osalogging.zip'. This could be indicative of an adversary collecting data from the local system before exfiltration.
This rule detects suspicious activity involving Node.js or Bun runtimes, specifically focusing on the access of sensitive configuration files (e.g., .npmrc, .aws/credentials, .ssh, .kube/config) or the execution of commands containing keywords associated with credential harvesting and automated data collection scripts.
Detects rapid access (three or more distinct files within a 60-second window) to sensitive files typically containing credentials or configuration data (e.g., SSH keys, AWS credentials, environment files, container configurations). This pattern is often associated with credential dumping or reconnaissance activity by an adversary attempting to harvest secrets.
Detects instances where 'node' or 'bun' runtime processes access multiple sensitive developer configuration or credential files (e.g., .ssh, .aws/credentials, .npmrc, .kube/config). This behavior is indicative of potential credential theft or reconnaissance activities by an adversary attempting to leverage developer environments.
Detects instances where the node.exe process attempts to read SSH configuration files or private key files (id_rsa, id_ed25519, etc.). This behavior is often associated with malicious packages or compromised scripts attempting to exfiltrate SSH credentials from the local file system. The rule includes exclusions for common node package manager installation paths and processes that appear to be performing legitimate package management or post-installation tasks.
Detects suspicious processes accessing, reading, or deleting browser credential stores (like 'Login Data', 'cookies.sqlite'). The rule specifically monitors for patterns where non-browser processes interact with these files, particularly when both file read and deletion actions are observed, which is a technique used by Remcos RAT to wipe existing sessions and force re-authentication for harvesting.
Detects the node.exe process attempting to read shell history files (.bash_history, .zsh_history, etc.), which are common targets for credential harvesting by malicious npm packages. This behavior is associated with the Polymarket Trap campaign involving Miasma and MYRA infostealers.
Detects node.exe processes attempting to access sensitive browser credential databases, such as cookies, login data, or key databases. This pattern is indicative of infostealer malware, specifically those associated with the Polymarket Trap supply-chain campaign, which abuse node.js processes to exfiltrate browser data.
Detects a single process reading both SSH private keys and various developer-sensitive configuration or credential files (e.g., .aws/credentials, .npmrc, .pypirc) on a single host. This behavior is consistent with infostealer activity, such as the Miasma JavaScript infostealer used in supply chain campaigns, aiming to harvest credentials from developer workstations.
Detects the Polymarket Trap / Miasma JavaScript-based infostealer attempting to access sensitive configuration files and credentials (SSH keys, AWS credentials, .npmrc, .pypirc, Docker config, and GPG keys) from a developer's workstation using node.js-related runtimes.
This rule detects the Miasma infostealer activity by monitoring for Node.js processes directly reading sensitive browser credential and cookie databases (e.g., 'Login Data', 'Cookies', 'logins.json') associated with Chrome, Brave, Chromium, and Firefox. The detection targets the behavior where malicious scripts use tools like sql.js to parse and harvest these local files for exfiltration.
Detects instances where a Node.js process accesses sensitive shell history files (e.g., .bash_history, .zsh_history) or the PowerShell PSReadLine history file (ConsoleHost_history.txt). Such activity may indicate an attempt by a malicious script or attacker to harvest credentials or commands stored in shell history.
Detects node.exe or node process accessing sensitive SSH private key files or configuration files. This behavior is indicative of unauthorized credential harvesting by malicious npm packages or infostealer malware like Miasma/MYRA attempting to exfiltrate developer secrets.
Detects instances where a Node.js process accesses or interacts with common web browser credential files, such as 'Login Data', 'Cookies', or 'key4.db'. This behavior is characteristic of credential-stealing malware or unauthorized collection scripts targeting browser-stored data.
This rule detects an unusually high volume of access attempts (20 or more within an hour) to a user's 'Documents' or 'Desktop' folders. This activity could indicate an adversary attempting to discover or collect sensitive data.
Page 35 of 46