Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
956 detections
Filters
Last updated
All Time
Detection languages
486
122
65
63
57
Contributors
328
210
131
82
29
Categories
504
436
202
184
173
Platforms
748
270
203
29
24
Products / Services
318
197
48
42
42
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
956
CVEs
4
3
2
2
2
IDS Classtypes
6
6
4
3
IDS Protocols
15
4
This rule detects an unusually high volume of object close operations (Event ID 4658) by a single user on a single computer within a one-hour window. This activity could indicate various malicious behaviors, including data collection for exfiltration, attempts to delete numerous files, or resource exhaustion attacks.
Detects the creation or modification of 'gh-token-monitor.sh', a script identified as part of the Miasma toolkit, used for harvesting developer credentials. This script's presence or alteration on a system indicates potential credential access attempts.
Detects access to browser profile data outside of authorized browser processes
Detects access to browser profile data outside of authorized browser processes
Hunting rule: correlate with additional signals before alerting. Detects recursive collection of office documents into a single archive, common pre-exfil staging.
Detects extraction of network device running configurations
This rule detects an unusually high volume of object close operations (Event ID 4658) by a single user on a single computer within a one-hour window. This activity could indicate various malicious behaviors, including data collection for exfiltration, attempts to delete numerous files, or resource exhaustion attacks.
This rule detects attempts to exploit a Local File Inclusion (LFI) vulnerability to read the `/etc/passwd` file on a web server. It specifically looks for HTTP requests where the URI contains the string `/etc/passwd`.
Detects the execution of 'cg.exe', a secondary compiled Python executable deployed by SilentRunLoader (associated with TA4922) to pack and steal Google Chrome browser data. The detection specifically looks for 'cg.exe' where the initiating process or command line contains 'python'.
Detects access to credential files through web shell commands
This rule detects attempts to exploit a Local File Inclusion (LFI) vulnerability to read the Windows Security Account Manager (SAM) database. It specifically looks for HTTP requests containing the string "\windows\system32\config\sam" in the URI, which is a common path for the SAM file on Windows systems. Successful exploitation of such a vulnerability could lead to the disclosure of hashed user credentials.
Detects the creation, modification, or renaming of 'btasc.cfg', a configuration file specifically associated with the JFMBackdoor malware. This file is used to store encrypted configuration data necessary for the backdoor's operation.
Detects suspicious processes attempting to access the Signal Desktop attachments directory. This behavior indicates potential data collection by post-compromise tooling, such as the InboxSetupPro second-stage tool observed in Nimbus RAT campaigns.
Detects the creation of 'configA.json' by a Python process, which indicates successful host profiling by KongTuke's ModeloRAT reconnaissance module. This file is typically dropped after the reconnaissance phase to store collected system information.
Detects file access patterns in the Downloads directory matching cryptocurrency wallet seeds, phrases, and private keys targeted by file grabbers like Amatera. The rule identifies bulk access (more than 3 sensitive files within 5 minutes) to files with specific keywords or extensions commonly associated with crypto wallets.
Detects unexpected access to PhoneExperiences-*.db files which may contain synchronized SMS and OTP messages. This behavior is associated with the CloudZ RAT and Pheno plugin bypassing SMS-based MFA.
Detects the creation of Pheno plugin output files (phonelink-<COMPUTERNAME>.txt) in the Microsoft feedback folder. This indicates the Pheno plugin is actively preparing to intercept PC-to-phone synchronization tools for OTP theft.
Detects unauthorized processes reading or accessing the 'PhoneExperiences' SQLite databases. This behavior may indicate an attempt to steal synchronized SMS messages or One-Time Passwords (OTPs) via the Microsoft Phone Link application, bypassing MFA without needing mobile malware.
Detects unusual processes accessing the RDP Terminal Server Client Cache folder, indicating potential reconnaissance or staging for exfiltration. Attackers target this cache to exfiltrate and reconstruct image fragments of past remote sessions.
Detects unusual processes accessing the RDP Terminal Server Client Cache folder, indicating potential reconnaissance or staging for exfiltration. Attackers target this cache to exfiltrate and reconstruct image fragments of past remote sessions.
Detects the execution of the TruffleHog secret scanning tool. This tool is often used by attackers to find sensitive information like credentials in various data sources (filesystems, Git repositories, cloud storage, etc.). This rule identifies the process creation of TruffleHog and categorizes the type of scan being performed. It includes exclusions for legitimate CI/CD environments or security scanners.
Page 40 of 46