Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
956 detections
Filters
Last updated
All Time
Detection languages
486
122
65
63
57
Contributors
328
210
131
82
29
Categories
504
436
202
184
173
Platforms
748
270
203
29
24
Products / Services
318
197
48
42
42
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
956
CVEs
4
3
2
2
2
IDS Classtypes
6
6
4
3
IDS Protocols
15
4
Detects suspicious processes attempting to access Microsoft Teams local storage or cookies via command line parameters, a technique commonly used by info-stealers. The rule specifically looks for command line arguments targeting 'Cookies' or 'Local Storage\leveldb' paths within the Microsoft Teams directory, while excluding legitimate Teams executables to reduce false positives.
Detects attempts to read raw disk data using mknod or dd, a technique observed in malicious npm packages to bypass permissions and extract secrets.
This rule detects unauthorized or suspicious direct access to sensitive SAP tables (such as USR02, which contains user credentials) when initiated specifically via an RFC (Remote Function Call) logon connection. This helps identify potential data exfiltration attempts or unauthorized reconnaissance of sensitive SAP security data.
Detects direct access to highly sensitive SAP tables (USR02, PAYR, P0002) via RFC logon. This specifically monitors for potential theft of user hashes (USR02), payroll data (PAYR), or personal employee information (P0002).
Detects information stealer malware with encrypted configuration parsing
Detects information stealer malware with encrypted configuration parsing
Detects ShadowSniff info-stealer based on strings, PDB path, and behavioral indicators.
Detects the creation of specific file artifacts (WhatsAppData.zip, whatsapp_backup.lock) associated with a Python-based WhatsApp stealer deployed by the Silver Fox (Void Arachne) intrusion set. This malware is designed to collect credentials and host data.
This rule detects the access or creation of Microsoft Office files (docx, xlsx, pptx) that have 'password' or related keywords in their filename or folder path. It also attempts to identify if these files contain password-related content through DLP indicators, suggesting potential sensitive data exposure or staging.
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
Detects the creation of temporary files used by the DarkSword implant to stage stolen data before exfiltration. After exploiting the device, the DarkSword implants copy sensitive user data to temporary files. Detecting the creation of these specific staging files is a strong indicator of compromise.
Detects process command lines containing strings characteristic of the GHOSTBLADE dataminer, a payload deployed by UNC6353 via the DarkSword exploit. These strings are hardcoded file paths used for data collection and exfiltration.
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
Detects a FortiGate configuration file download occurring within 10 minutes of a successful administrative login from the same user and source IP address. This rapid sequence of events can indicate an attacker who has gained administrative access and is proceeding to exfiltrate sensitive configuration data, which may contain credentials for other systems.
Detects the execution of shell or system utilities (e.g., powershell, cmd, curl) where the parent process is a known AI agent binary like OpenClaw. This activity can indicate that an attacker has compromised the AI agent (e.g., via the ClawJacked vulnerability) and is using its capabilities to execute arbitrary commands, collect data, or exfiltrate information from the host system.
Detects the use of the GNU Debugger (GDB) to dump memory from a live process. This technique is used by frameworks like ShadowHS to extract credentials and other secrets directly from memory, bypassing file-based security controls.
Detects DKnife text markers and config file names referenced by Cisco Talos (dkimsi tag, default IMSI, credential tag, and common DKnife config artefact names).
Detects creation of the LunarApplication directory used by an infostealer to stage credential and cryptocurrency theft.
Detects suspicious file staging activity in Temp directory structures commonly used for data exfiltration preparation. Includes credential folders, system information collection, and archive creation
This query utilizes the IOCs provided by Rapid7 and focuses on columns in the DeviceFileEvents, DeviceProcessEvents and DeviceNetworkEvents tables. This is a high FP query, however each event will require an investigation to its legitimacy. The query accounts for all devices that have installed notepad++ in the past 400d and only looking for IOCs within time of known compromise in order to save on resources. Some IOCs are commented out due to high FP rate.
This rule detects suspicious activity related to browser credential theft or staging. It triggers when a non-browser process accesses sensitive browser files (like 'Login Data' or 'Local State') or when temporary artifacts associated with credential stealer activity ('chromeTmp', 'Local State-journal') are created. This behavior is indicative of an attacker attempting to exfiltrate browser-stored credentials.
Page 41 of 46