Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
956 detections
Filters
Last updated
All Time
Detection languages
486
122
65
63
57
Contributors
328
210
131
82
29
Categories
504
436
202
184
173
Platforms
748
270
203
29
24
Products / Services
318
197
48
42
42
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
956
CVEs
4
3
2
2
2
IDS Classtypes
6
6
4
3
IDS Protocols
15
4
This rule detects when a non-Outlook process running as SYSTEM accesses or creates PST or OST mailbox data files. The logic specifically excludes legitimate Outlook, searchindexer, or searchprotocolhost activity to focus on suspicious mailbox collection sequences.
Detects access or modification attempts to KeePass (.kdbx) password database files by processes other than authorized KeePass applications. This behavior often indicates an attempt to exfiltrate or crack credential stores.
Detects unauthorized access to web browser sensitive files, including credential stores, cookies, and local state files, by processes other than standard browsers or their update mechanisms. This rule also flags access to specific staging directories or archive files associated with known malicious activity.
Detects unauthorized processes attempting to read KeePass database files (.kdbx) or VPN configuration files (.ovpn, .vpn) from user directories. This behavior is consistent with the GIFTEDCROOK stealer and UAC-0226 activity, aimed at harvesting credentials from password managers and VPN clients.
Detects instances where non-browser processes (that are not signed by major browser vendors) attempt to access common browser credential files such as 'Login Data' or 'logins.json'. This behavior is characteristic of credential dumping or exfiltration attempts by malicious software trying to steal stored browser passwords.
Detects non-browser processes accessing sensitive browser data files (such as Login Data, Cookies, or key stores) followed by network activity to known suspicious, cryptocurrency, or potential malware-hosting domains. This behavior is indicative of credential theft and exfiltration by information-stealing malware.
Detects the execution of command-line archiving utilities (7z, rar, tar) invoked by common scripting engines (PowerShell, CMD, Python, etc.) targeting typical staging directories (Temp, Public, AppData, ProgramData). This pattern is frequently observed during the data staging phase of an attack, where adversaries encrypt or compress gathered files for eventual exfiltration.
Detects potential information stealing activity, specifically the Atomic macOS Stealer (AMOS) malware, by monitoring unauthorized processes accessing Safari cookies and Apple Notes databases, excluding legitimate applications.
This rule detects when the Internet Information Services (IIS) worker process (w3wp.exe) accesses sensitive files such as 'web.config', 'applicationHost.config', or 'win.ini'. Unauthorized access to these files by the IIS process can be an indicator of a web shell or other malicious post-exploitation activity attempting to steal credentials, application secrets, or system configuration information.
This rule detects Node.js or Bun processes interacting with sensitive configuration, credential, or authentication files, or executing processes with specific, suspicious command-line markers associated with malicious behavior (e.g., Miasma). This is often indicative of credential theft or discovery activities by an attacker leveraging script interpreters.
This rule detects Node.js or Bun processes interacting with sensitive configuration, credential, or authentication files, or executing processes with specific, suspicious command-line markers associated with malicious behavior (e.g., Miasma). This is often indicative of credential theft or discovery activities by an attacker leveraging script interpreters.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories. This activity is associated with the 'protocal.cjs' backdoor from the easy-day-js supply chain attack, which aims to exfiltrate sensitive browser data.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories, potentially indicating data exfiltration or staging. This behavior has been observed in supply chain attacks like the 'easy-day-js' incident involving the 'protocal.cjs' backdoor.
Time-series correlation identifying the powershell process rapidly scraping browser extensions and local storage files. This rule detects suspicious file access patterns where a process rapidly accesses multiple files within browser-related folders (Local Extension Settings, Network Persistent State, Cookies, Login Data). A count of more than 5 unique file accesses within a one-minute window by the same process on the same device triggers the alert.
Detects the Grixba infostealer (v1.5+) enumerating sensitive browser data (history, cookies, etc.) from multiple common web browsers. The rule monitors for file access events initiated by processes running from non-standard locations such as C:\Users\Public\Music\ or identified by specific .NET binary names associated with Grixba.
Detects the execution of 7-Zip (7za.exe) with specific command-line arguments that include a password, a specific data file (data2.bin), and references to Avast antivirus. This pattern is indicative of potential unauthorized data staging or decryption operations, possibly involving malicious archives intended to bypass security controls.
Detects Hannibal Stealer reconnaissance activity involving the creation of a 'config.json' file within the 'SCef.WindowsAdapter' directory, correlated with suspicious process executions attempting to enumerate system information via 'GetComputerNameEx' or 'GetAdaptersInfo' API calls.
Detects queries extracting large contact lists or license details ($top=999 or $top=1000) via Microsoft Graph API, indicating automated data harvesting or reconnaissance activities. This behavior could be indicative of an adversary attempting to collect information about an organization's users or licensed software.
Detects PowerShell processes searching for .docx and .txt files in cloud sync directories.
Detects the execution of VILE ransomware by identifying specific dropped file artifacts (vile_icon.ico, vile_deadlines.json, vile_user_files.zip) and correlating these file events with outbound network connections made by the same process to remote non-private IP addresses, indicating the likely exfiltration of harvested system metadata.
Detects anomalous network communication with a known C2 domain associated with the Miasma worm, or attempts by JavaScript runtime processes (node, bun) to access sensitive developer-related files (SSH keys, cloud credentials, browser data) without an authorized IDE parent process.
Page 37 of 46