Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
956 detections
Filters
Last updated
All Time
Detection languages
486
122
65
63
57
Contributors
328
210
131
82
29
Categories
504
436
202
184
173
Platforms
748
270
203
29
24
Products / Services
318
197
48
42
42
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
956
CVEs
4
3
2
2
2
IDS Classtypes
6
6
4
3
IDS Protocols
15
4
This rule detects unauthorized or suspicious file access to sensitive configuration, credential, and identity files by 'node.exe' or 'bun.exe' processes. It flags instances where these runtime processes access multiple unique sensitive files, excluding those officially associated with the Node.js or OpenJS Foundations, which is a common indicator of credential exfiltration or reconnaissance by malicious scripts in an environment.
Detects the execution of 'rar.exe' with specific command-line arguments indicative of file archiving or extraction (using switches like '-k', '-r', '-s', '-t', '-o-p'). The rule monitors for instances where this activity originates from a web server process (w3wp.exe) or command interpreter (cmd.exe), or involves specific sensitive paths like backups or VMware configuration directories, which may suggest unauthorized data staging or exfiltration preparation.
This rule detects potential command and control (C2) communication by monitoring for connections to known malicious domains or IP addresses and identifies the creation of suspicious staging files (specifically 'debug.txt') commonly used to collect or exfiltrate data.
Detects a non-browser process creating copies of at least three Chromium credential or browsing databases in a temporary, roaming, public, or program-data directory. The logic requires the reported SessionGate, Remus, or AnimateClipper structure rather than a standalone executable name.
Detects the use of archive utilities (tar, zip, 7z, gzip, zstd) to bundle sensitive PeopleSoft configuration and application directories (e.g., ps_config_homes, psoft/psft). This behavior is consistent with data staging for exfiltration, frequently associated with the ShinyHunters threat group activity targeting exposed PeopleSoft environments.
Detects unauthorized file read operations targeting local cryptocurrency wallet directories and browser extension storage (MetaMask, Phantom, etc.) by suspicious processes (e.g., node.exe, chost.exe) or processes executing from temporary or user-writable application directories, commonly associated with infostealer malware.
Detects macOS Python processes creating zip archives in temporary or 'collected_data' folders, potentially indicating data collection and exfiltration staging. The rule specifically looks for Python processes that have previously accessed sensitive paths like 'login.keychain-db' or performed data collection/compression activities.
Detects attempts to copy sensitive configuration or credential files (e.g., .ssh, .zshrc, .bash_history, .gitconfig, .kube, .aws) to a suspicious temporary directory '/tmp/sync' on macOS systems using common shell commands like 'cp', 'bash', 'zsh', or 'sh'. This activity could indicate an adversary staging data for exfiltration or further malicious use.
Detects the use of tar.exe to extract archives into common staging directories (Temp, AppData, Public, ProgramData), particularly when the process is initiated by suspicious parent processes such as Office applications, command shells, or download utilities, which is often indicative of malicious payload staging.
Detects unauthorized access (File Creation, Modification, Rename, or Deletion) to common web browser cookie and credential storage files by non-browser processes. This behavior is a common indicator of information-stealing malware attempting to extract session cookies and credentials for later use.
This rule detects attempts by unsigned or suspicious processes (often residing in temporary directories) to access sensitive cryptocurrency wallet files such as 'wallet.dat', keystore JSON files, and files containing recovery seed phrases. This behavior is indicative of credential theft commonly associated with infostealer campaigns like DeepLoad and DeerStealer.
Detects recursive listing or search commands targeting OneDrive directories from a shell or script interpreter. This activity could indicate an attacker attempting to discover sensitive files within a user's OneDrive.
Detects the use of the 'watch' command in conjunction with 'cat' to continuously poll the GitHub CLI config file (.config/gh/hosts.yml). This activity could indicate an attacker attempting to capture new GitHub tokens as soon as a developer logs in.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories. This activity is indicative of data staging or collection, specifically linked to the 'protocal.cjs' backdoor from the 'easy-day-js' supply chain attack.
Detects Python recursively searching repositories for .env files, package credentials, API keys, access tokens, or connection strings. This activity is associated with the InvisibleFerret malware.
Detects Python creating an archive containing browser, wallet, developer, cloud, and authentication data from multiple collection roots. This activity is associated with the InvisibleFerret malware.
SYSTEM-Context PST or OST Collection
Cortex XDR
This rule detects suspicious access to Outlook data files (.pst or .ost) by processes running in the SYSTEM context, excluding legitimate Outlook-related processes. It focuses on identifying non-standard applications or scripts attempting to collect mailbox data, potentially indicating data exfiltration or unauthorized access. The rule leverages causality fields for enhanced investigation.
Detects the browser data collection routines matching Opcodes 0x23 (Chrome) and 0x2B (Edge) creating database snapshots, specifically looking for file creations with names matching 'chrome_backup' or 'edge_backup' initiated by 'setup.exe'.
Identifies the PHP or VBS payload iterating through roaming profiles to extract high-value cryptocurrency files (wallet.dat, key4.db, .kdbx). This rule specifically looks for file access events on these sensitive files when initiated by 'cscript.exe' (VBScript host) or 'php.exe' (PHP interpreter).
Detects Hannibal Stealer reconnaissance activity involving the creation of a 'config.json' file within the 'SCef.WindowsAdapter' directory, correlated with suspicious process executions attempting to enumerate system information via 'GetComputerNameEx' or 'GetAdaptersInfo' API calls.
This rule detects potential credential harvesting activity associated with the Hannibal Stealer. It looks for non-standard processes (processes other than the browsers themselves) that access sensitive browser credential stores (like 'Login Data', 'cookies.sqlite', or 'key4.db') and correlate these file access events with the loading of 'bcrypt.dll' or 'CefSharp.BrowsersSubprocess.dll', which are often used for decryption or browser automation/sub-processes during credential theft.
Page 38 of 46