Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
956 detections
Filters
Last updated
All Time
Detection languages
486
122
65
63
57
Contributors
328
210
131
82
29
Categories
504
436
202
184
173
Platforms
748
270
203
29
24
Products / Services
318
197
48
42
42
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
956
CVEs
4
3
2
2
2
IDS Classtypes
6
6
4
3
IDS Protocols
15
4
Detects a multi-stage, automated attack chain performed by AI-based development agents (e.g., Claude, Copilot, Cursor). The rule correlates process discovery, credential access, file collection (staging), and exfiltration over web services within a tight 15-minute window, identifying potential autonomous exploitation and data exfiltration. Covered T1046, T1552.001, T1078, T1005, T1567
Detects a multi-stage, automated attack chain performed by AI-based development agents (e.g., Claude, Copilot, Cursor). The rule correlates process discovery, credential access, file collection (staging), and exfiltration over web services within a tight 15-minute window, identifying potential autonomous exploitation and data exfiltration. Covered T1046, T1552.001, T1078, T1005, T1567
Detects AI agent tooling (e.g., LangChain, Copilot, Claude Code) performing read operations on databases containing sensitive data patterns, or performing suspicious bulk data enumeration. The rule monitors Azure SQL Database security audit events for suspicious application name signatures and non-schema introspective queries.
Detects instances where AI developer tools or IDE assistants (e.g., Claude, Copilot, Cursor) execute data collection commands (such as directory traversal or archiving) followed by or concurrent with the bulk access of sensitive files (credentials, configuration files) or personal user data.
Detects instances where AI developer tools or IDE assistants (e.g., Claude, Copilot, Cursor) execute data collection commands (such as directory traversal or archiving) followed by or concurrent with the bulk access of sensitive files (credentials, configuration files) or personal user data.
Detects instances where AI developer tools or IDE assistants (e.g., Claude, Copilot, Cursor) execute data collection commands (such as directory traversal or archiving) followed by or concurrent with the bulk access of sensitive files (credentials, configuration files) or personal user data.
Detects instances where AI-based coding or agent-driven tools (e.g., Cursor, Claude Code, AutoGPT) perform suspicious file archiving/packaging activities followed by network egress to unauthorized or known exfiltration-prone services. This helps identify potential data exfiltration by AI agents or compromised development environments.
Detects instances where AI-based coding or agent-driven tools (e.g., Cursor, Claude Code, AutoGPT) perform suspicious file archiving/packaging activities followed by network egress to unauthorized or known exfiltration-prone services. This helps identify potential data exfiltration by AI agents or compromised development environments.
Detects instances where AI coding and agent tools (e.g., Claude Code, Cursor, Copilot CLI, Ollama, LangGraph) create archive or database files containing potentially sensitive data and subsequently initiate network connections to non-AI-provider or non-developer services (exfiltration services or non-standard port connections).
Detects unauthorized processes reading Chromium or Firefox cookie and login stores that specifically reference Claude.ai or Anthropic domains. This rule is designed to identify infostealer malware attempting to hijack active Claude sessions by analyzing process file access and command-line arguments, filtered against known-legitimate security, sync, and development tools. The detection logic mandates corroborating evidence of suspicious execution paths or subsequent outbound network activity.
Detects unauthorized processes attempting to read or copy sensitive browser data files (e.g., Cookies, Login Data, Local Storage) often targeted by info-stealing malware such as Vidar, LummaC2, or RedLine. The rule filters out legitimate browser-related processes and adds security context by requiring evidence of unsigned code, execution from suspicious locations (Temp/Downloads), or associated outbound network activity to reduce false positives.
Detects SectopRAT (Arechclient2) .NET RAT binaries deployed via tampered libcef.dll / JetBrains helper DLL sideloading that harvest browser credentials, cookies, credit card data, and files. Tightened to require combined sideload+family+target indicators plus .NET CLR import evidence, avoiding standalone generic strings.
Detects non-browser and non-messaging processes accessing both browser credential stores (like 'Login Data' or 'Cookies') and messaging application session storage (Slack/Discord LevelDB) in a single session. This pattern is characteristic of credential-stealing malware, such as RevStealer, which targets both saved web browser credentials and application session tokens for exfiltration.
This rule monitors for file creation or existence patterns in the user's Local Temp directory that are commonly associated with infostealer malware, specifically looking for naming conventions like 'evo_cl_*.exe', 'evo_db_*.db', or the presence of a 'stolen.zip' file within subdirectories.
This rule detects the use of xcopy.exe with a specific set of flags (/s, /e, /y, /c, /q, /h, /b) typically used for recursive, forced, and quiet file copying, when executed from a path matching 'C:\Users\Public\[A-Za-z0-9]+'. This behavior is often associated with adversaries staging data for exfiltration or moving lateral movement tools within a compromise directory.
Detects activity associated with the CARBONATO botnet utilizing the GH0ST RAT agent to locate, stage, and exfiltrate sensitive AI API keys. The detection monitors for file write operations within specific hidden directories ('/root/.hermes/loot/') and the use of malicious command-line patterns or process context associated with Hermes Agent or GH0ST malware to search for configuration files (e.g., .env) containing sensitive API credentials.
Detects activity associated with the CARBONATO botnet utilizing the GH0ST RAT agent to locate, stage, and exfiltrate sensitive AI API keys. The detection monitors for file write operations within specific hidden directories ('/root/.hermes/loot/') and the use of malicious command-line patterns or process context associated with Hermes Agent or GH0ST malware to search for configuration files (e.g., .env) containing sensitive API credentials.
Detects activity associated with the CARBONATO botnet utilizing the GH0ST RAT agent to locate, stage, and exfiltrate sensitive AI API keys. The detection monitors for file write operations within specific hidden directories ('/root/.hermes/loot/') and the use of malicious command-line patterns or process context associated with Hermes Agent or GH0ST malware to search for configuration files (e.g., .env) containing sensitive API credentials.
Detects activity associated with the CARBONATO botnet utilizing the GH0ST RAT agent to locate, stage, and exfiltrate sensitive AI API keys. The detection monitors for file write operations within specific hidden directories ('/root/.hermes/loot/') and the use of malicious command-line patterns or process context associated with Hermes Agent or GH0ST malware to search for configuration files (e.g., .env) containing sensitive API credentials.
Detects activity associated with the CARBONATO botnet utilizing the GH0ST RAT agent to locate, stage, and exfiltrate sensitive AI API keys. The detection monitors for file write operations within specific hidden directories ('/root/.hermes/loot/') and the use of malicious command-line patterns or process context associated with Hermes Agent or GH0ST malware to search for configuration files (e.g., .env) containing sensitive API credentials.
TokenGrabber Builder: Webhook XOR/Base64 Obfuscation Artifacts - detects webhook.txt persistence, XOR 0x5A + Base64 webhook obfuscation, WEBHOOK_PLACEHOLDER injection, and the _x() decode routine used to recover the exfiltration endpoint
Page 8 of 46