Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
956 detections
Filters
Last updated
All Time
Detection languages
486
122
65
63
57
Contributors
328
210
131
82
29
Categories
504
436
202
184
173
Platforms
748
270
203
29
24
Products / Services
318
197
48
42
42
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
956
CVEs
4
3
2
2
2
IDS Classtypes
6
6
4
3
IDS Protocols
15
4
This rule detects when non-FileZilla processes attempt to read or access sensitive FileZilla configuration files, specifically 'recentservers.xml' or 'sitemanager.xml', which are known to store plain-text credentials for site connections. This behavior is indicative of credential harvesting.
This rule detects when 'pythonw.exe' performs a high volume of distinct database file reads (5 or more) within a 3-minute window. This behavior is indicative of potential credential harvesting or data exfiltration by malicious Python scripts, as described in the referenced blog post about threat actors using AI hype in social engineering campaigns.
Detects when a non-Outlook process running as SYSTEM accesses Outlook mailbox data files (.pst or .ost). This rule focuses on identifying suspicious access to sensitive email data outside of normal application behavior, retaining principal and target context for correlation.
Detects the gh-token-monitor script using grep to extract GitHub Classic or Fine-Grained tokens (matching the ghp_ or gho_ structure) from the filesystem. This rule specifically looks for process command lines containing 'grep' and the regex pattern 'gh[po]_[a-zA-Z0-9]{36}', which is indicative of searching for GitHub tokens.
Detects a non-Firefox process creating staged copies of at least three NSS, login, cookie, history, or preference files from Firefox-style profiles. The logic requires the reported SessionGate, Remus, or AnimateClipper structure rather than a standalone executable name.
Uses time-windowing to detect a single anomalous process rapidly opening multiple telecom billing/radius .xml or .cfg files, indicating automated config parsing prior to exfiltration.
This rule detects rapid access to specific classified document types (.doc, .docx, .pdf, .xls) followed by network egress to identified C2 structures within a 5-minute window. It correlates file access events for sensitive document types with subsequent network connections initiated by the same process on the same device.
Detects hollowed MsBuild process accessing Discord or Crypto wallet files.
Detects access to SSL/TLS private key files by unauthorized processes
Detects bulk file reading from network shares for data collection
Detects the execution of the 'moladb_superusers.py' script, which is associated with the MuddyWater threat group for database enumeration.
Detects the archiving (tar or zip) of .git directories. This activity can indicate an adversary attempting to exfiltrate full source code history and internal intellectual property.
Monitors the Node package manager engine performing mass file reads of all .pub files in the SSH keys path. This rule specifically looks for 'node.exe' accessing multiple files ending with '.pub' within folders containing '.ssh'.
Detects PowerShell reading from cryptocurrency extension folders (e.g., MetaMask). This rule specifically looks for file access events where the initiating process is PowerShell (powershell.exe or pwsh.exe) and the accessed folder path contains the unique identifier for a known cryptocurrency extension.
Detects the extraction of a ZIP archive via tar.exe to the %TEMP% directory. This activity is often associated with malware unpacking or staging, where an adversary extracts malicious content into a temporary location for execution.
This rule detects an unusually high volume of access attempts (20 or more within an hour) to a user's 'Documents' or 'Desktop' folders. This activity could indicate an adversary attempting to discover or collect sensitive data.
Detects bulk cloning of GitHub repositories for source code collection
Detects copying of Outlook PST/OST files for email collection
Hunting rule: correlate with additional signals before alerting. Detects recursive collection of office documents into a single archive, common pre-exfil staging.
Detects bulk file reading from network shares for data collection
Detects when a non-Outlook process running as SYSTEM accesses Outlook mailbox data files (.pst or .ost). This rule focuses on identifying suspicious access to sensitive email data outside of normal application behavior, retaining principal and target context for correlation.
Page 39 of 46