Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
956 detections
Filters
Last updated
All Time
Detection languages
486
122
65
63
57
Contributors
328
210
131
82
29
Categories
504
436
202
184
173
Platforms
748
270
203
29
24
Products / Services
318
197
48
42
42
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
956
CVEs
4
3
2
2
2
IDS Classtypes
6
6
4
3
IDS Protocols
15
4
Detects Node.js processes, such as npm package postinstall hooks, spawning shell commands used for host enumeration. This includes accessing system environment variables, network configurations, and filesystem metadata, a pattern frequently utilized by malicious packages for initial reconnaissance post-installation.
Detects outbound HTTP POST requests associated with the Psychedelic Stealer malware, which attempts to exfiltrate data from web browser-based cryptocurrency wallet extensions by targeting specific API endpoints and wallet extension IDs.
Detects the creation of specific forensic log files (browser_decryption.log, sends.log) within the %TEMP% directory. These files are indicators of the data collection stage performed by the Rapuncel infostealer prior to archiving and exfiltration.
Detects unauthorized access to web browser credential stores (e.g., Login Data, Cookies) by non-browser processes, such as scripting engines (PowerShell, WScript) or common LOLBins (MSBuild, InstallUtil). This behavior is indicative of credential theft or data exfiltration attempts by malicious software, including stealers like PureLog.
Detects access to sensitive cryptocurrency wallet files (e.g., wallet.dat, keystore) by processes typically associated with LOLBins (Living-off-the-land Binaries) like PowerShell, MSBuild, or non-executable utilities. This activity is indicative of credential theft or data staging for exfiltration of cryptocurrency assets.
This rule detects potential data staging activity associated with the REMUS malware. It correlates Windows Management Instrumentation (WMI) queries for antivirus information (e.g., 'AntiVirusProduct', 'WbemLocator') with subsequent file creation events in non-standard directories. This behavior is indicative of an adversary preparing or staging system profile data for exfiltration.
Detects instances where a process not associated with standard web browsers accesses, copies, or modifies sensitive browser files such as cookies, local storage, or session tokens. This behavior is highly indicative of information-stealer malware (e.g., Vidar, Lumma, RedLine) attempting to exfiltrate session data for account hijacking.
Detects activity associated with a potential RMM (Remote Monitoring and Management) agent communicating with known malicious infrastructure and accessing sensitive files like credentials or IDs. This often indicates an adversary leveraging legitimate RMM tooling for post-compromise activity or exfiltration.
Detects infostealer malware (e.g., Vidar, Lumma, RedLine) that specifically searches for Claude/Anthropic session cookies, API tokens, and generic browser-based credential storage artifacts.
Detects instances where processes other than standard web browsers attempt to access sensitive browser data files, such as cookies, login data, and browser state files. This behavior is a common indicator of credential theft or browser session hijacking, often performed by stealer malware like OnyxC2.
Detects instances where processes other than standard web browsers attempt to access sensitive browser data files, such as cookies, login data, and browser state files. This behavior is a common indicator of credential theft or browser session hijacking, often performed by stealer malware like OnyxC2.
Detects access or interrogation of the WinGet configuration history database (config.db) by non-standard or user-supplied Python scripts, which may indicate an attempt to enumerate installed package configurations or extract sensitive information from the local configuration state.
Detects the creation of files in the Windows Temp directory that match specific naming patterns associated with UnixStealer, including tool executables, database files, stolen data archives, and debug logs. These artifacts are characteristic of the tool's staging and activity tracking behaviors.
Detects unauthorized access to VPN configuration files associated with common VPN providers (CyberGhost, NordVPN, ExpressVPN). This behavior is characteristic of the Hannibal Stealer, which attempts to exfiltrate these files to compromise user VPN sessions and credentials. The rule filters out legitimate process access to minimize false positives.
This rule detects malicious activity associated with the Bazinga macOS backdoor, specifically focusing on the clearing of TCC privacy permissions, the staging of keychain and browser data using 'ditto', and the subsequent exfiltration of this data to a remote host via 'curl'.
This rule detects malicious activity associated with the Bazinga macOS backdoor, specifically focusing on the clearing of TCC privacy permissions, the staging of keychain and browser data using 'ditto', and the subsequent exfiltration of this data to a remote host via 'curl'.
Detects the creation of 'auth_codes.json' files within directories containing 'seria' in their path. This file is known to be used to store MD5-derived 8-character hex recovery codes for Dahua devices, allowing for password bypass or recovery via the easy4ipcloud.com portal without valid credentials.
This rule detects the creation of XML files matching the 'export_batch_*.xml' naming convention, which is consistent with the output pattern of the Dahua DeviceManager utility. Attackers often use this tool to export camera configuration files containing sensitive credentials (IP, Port, Username, Password). The rule flags activity where multiple such files are created in a short duration, suggesting potential mass exfiltration of camera credentials.
Detects unauthorized export and outbound exfiltration of MikroTik RouterOS .rif diagnostic files. These files contain sensitive device configuration data and are often targeted during the final stage of the 'MikroTrick' attack chain, following administrative credential compromise.
Detects a multi-stage, automated attack chain performed by AI-based development agents (e.g., Claude, Copilot, Cursor). The rule correlates process discovery, credential access, file collection (staging), and exfiltration over web services within a tight 15-minute window, identifying potential autonomous exploitation and data exfiltration. Covered T1046, T1552.001, T1078, T1005, T1567
Detects a multi-stage, automated attack chain performed by AI-based development agents (e.g., Claude, Copilot, Cursor). The rule correlates process discovery, credential access, file collection (staging), and exfiltration over web services within a tight 15-minute window, identifying potential autonomous exploitation and data exfiltration. Covered T1046, T1552.001, T1078, T1005, T1567
Page 7 of 46