Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
644 detections
Filters
Last updated
All Time
Detection languages
237
196
93
34
26
Contributors
178
129
64
62
42
Categories
214
185
178
157
144
Platforms
507
161
73
9
8
Products / Services
123
72
48
45
35
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
3
3
2
1
1
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects the execution of wscript.exe or cscript.exe which are commonly used to execute VBScript files for performing host reconnaissance tasks such as process enumeration via WMI and file system discovery using Scripting.FileSystemObject.
Detects bulk file access or modifications in sensitive directories (Desktop, Documents, Downloads) targeting credential and document files (ovpn, kdbx, jks, eml, docx, xlsx, pdf), or direct PowerShell access to OpenVPN configuration or KeePass database files. This behavior is indicative of data staging or exfiltration activities associated with the GIFTEDCROOK stealer.
This rule monitors for processes attempting to enumerate sensitive environment variables related to cloud services (AWS) and AI platforms (Anthropic), or access specific configuration and credential files (e.g., .aws/credentials, .config/anthropic). It specifically correlates these behaviors with potentially suspicious parent processes like bash, node, or python interpreters, which may indicate an AI agent or a reverse shell performing reconnaissance or credential exfiltration.
This rule detects shell commands (bash, sh, zsh) initiated by AI-agent or development-related processes (e.g., Python, Claude Desktop, openclaw) that target sensitive macOS paths associated with credentials, SSH keys, crypto wallets, and browser cookies, a technique characteristic of the Atomic Stealer (AMOS) malware.
This rule detects suspicious activity associated with potential threat actor staging patterns, specifically monitoring for the usage of temporary directories like 'wdtest_temp', file path manipulation involving 'RP_*' (often related to shadow copy or system restore point paths), and the execution of 'wermgr.exe' from non-standard locations. It also identifies non-SYSTEM processes attempting to enumerate Volume Shadow Copy Service (VSS) devices using commands like 'NtQueryDirectoryObject' or referencing 'HarddiskVolumeShadowCopy'.
Detects Server-Side Request Forgery (SSRF) attempts targeting cloud provider metadata services (specifically GCP) or sensitive local files like '/proc/self/environ' using common bypass patterns and request structures. These requests typically originate from an application process attempting to access internal environment variables or cloud identity metadata.
This rule detects common web application processes (such as nginx, python, node, etc.) accessing the /proc/[pid]/environ file, which contains environment variables that may include sensitive information like credentials or configuration secrets. The rule correlates this access with subsequent external network connections initiated by the same process, which is highly indicative of data exfiltration after sensitive information has been retrieved.
This rule detects activities associated with VILE ransomware, focusing on unsigned Go-based binaries. It flags processes performing cross-process operations, creating specific file artifacts (e.g., vile_deadlines.json, vile_Decryptor), or invoking direct NT system calls such as NtCreateWaitCompletionPacket to evade EDR hooks.
Detects instances where files located in root or non-standard paths are opened by processes that are not core Windows system processes or Microsoft security products, which may indicate suspicious activity such as manual file interaction or discovery.
This rule monitors process command lines and file activity for keywords associated with potential reconnaissance, error logs, or debugging artifacts often used during post-exploitation or system profiling. It flags commands or files containing terms like 'memory dump', 'stack trace', 'SQL injection', or 'Redis failure', which may indicate an attacker analyzing system information or attempting to interact with backend services.
Detects a multi-stage attack where an adversary reads local AWS credentials or configuration files (e.g., .aws/credentials, mcp.json) on a developer workstation and subsequently performs unauthorized AWS API calls from the same source IP. The rule correlates initial credential access on the endpoint with a sequence of AWS CloudTrail events starting with identity verification (GetCallerIdentity) followed by enumeration and potentially high-impact API calls (e.g., RunInstances, AssumeRole).
Detects Python or Node.js processes accessing files associated with cryptocurrency wallets and browser extension storage. This behavior is indicative of credential or wallet theft, as observed in campaigns such as 'Contagious Interview' which involved threats like BeaverTail and InvisibleFerret.
This rule detects potentially malicious data exfiltration activity. It identifies sequences of events where a process performs file enumeration (directory listing), followed by the creation of a ZIP or RAR archive in temporary or local application data directories with randomized filenames. Finally, it correlates this behavior with subsequent outbound network connections from the same process to known cloud storage and file-sharing providers, flagging anomalous archive creation rates.
Detects Node.js or npm processes that access multiple SSH-related files within a short timeframe while also establishing external network connections, which is consistent with credential exfiltration patterns.
This rule detects multiple unauthorized access attempts to files identified as machine learning models, weights, or checkpoints. It specifically looks for Security Event ID 4656 (Auditing of object access) where the object name contains keywords like 'model', 'weights', or 'checkpoint', and the access mask indicates unauthorized access attempts (0x0001 for ReadData or ListDirectory, 0x0002 for WriteData or AddFile). The rule then summarizes these attempts by user, computer, and hour, triggering an alert if 5 or more attempts are made within an hour.
This rule detects an unusual number of file creations or modifications where the filename contains keywords like 'patch', 'update', or 'fix' by a single account within a one-hour window. This could indicate an automated patching process, software deployment, or potentially malicious activity attempting to modify system files under the guise of an update.
Detects web application processes (such as nginx, gunicorn, uvicorn, python, node, or java) attempting to read sensitive information from /proc/self, specifically /proc/self/environ, /proc/self/cmdline, or /proc/self/maps. This behavior is indicative of a Local File Read (LFR) vulnerability exploitation, which an attacker may use to exfiltrate environment variables containing secrets or Cloud Run service account credentials.
Detects incoming HTTP requests that use URL-encoding (e.g., %2e%2e, %2f) to obfuscate path traversal sequences targeting sensitive operating system or container application files, such as /proc/self/environ or /etc/passwd. This technique is often used to bypass security filters or URL validation mechanisms in web applications.
This rule detects the invocation of local AI/LLM CLI utilities (e.g., ollama, llama-cpp) by potentially malicious or automated parent processes. It specifically flags scenarios where non-interactive or scripting-based processes (such as WScript, PowerShell, or Python) attempt to use these AI tools, particularly when the command line includes keywords related to sensitive data discovery, such as 'password', 'token', or 'private key'. This behavior is characteristic of infostealer activity (e.g., QUIETVAULT) attempting to use AI tools for automated reconnaissance and credential extraction.
Detects the use of the 'cp' command within a Docker container context to access files outside the current working directory, identified by the usage of parent directory traversal (..). This pattern is often associated with container escape attempts or unauthorized file access within a containerized environment.
This rule detects processes attempting to access sensitive Linux system files (/proc/[pid]/environ or /proc/[pid]/cmdline) or the specific file 'linux-process-env.json'. Such actions are indicative of an adversary attempting to perform system discovery, dump process environment variables for secrets, or collect process metadata.
Page 10 of 31