Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
644 detections
Filters
Last updated
All Time
Detection languages
237
196
93
34
26
Contributors
178
129
64
62
42
Categories
214
185
178
157
144
Platforms
507
161
73
9
8
Products / Services
123
72
48
45
35
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
3
3
2
1
1
IDS Classtypes
2
1
1
IDS Protocols
3
1
This rule detects a single process attempting to access credential-related files (e.g., browser login data, FTP client configurations) and/or registry keys (e.g., PuTTY, WinSCP sessions) from at least two different application types within a 60-second window. This behavior is indicative of an attacker attempting to rapidly harvest credentials from various sources on a compromised endpoint.
This rule detects attempts by non-browser processes to access sensitive files that commonly contain credentials, such as browser login data (Chrome, Firefox) or the Windows Security Account Manager (SAM) database. This activity could indicate credential dumping or information theft.
Detects instances where node.exe processes attempt to access sensitive configuration files, specifically AWS credential or configuration files, or .env files associated with common package installation or session management operations. This behavior may indicate an attempt to exfiltrate credentials from a developer or build environment.
This rule detects suspicious command-line activity by looking for the presence of keywords such as 'risk', 'threat', or 'exposure' in process creation command lines (Event ID 4688). It then aggregates these events by computer and account over one-hour intervals and flags if 3 or more such activities occur within that hour, indicating potential reconnaissance or malicious activity.
This rule detects an unusual number of file creations or modifications where the filename contains keywords like 'patch', 'update', or 'fix' by a single account within a one-hour window. This could indicate an automated patching process, software deployment, or potentially malicious activity attempting to modify system files under the guise of an update.
This rule detects when a single process creates or modifies 3 or more JSON files within a folder path containing 'package' within a one-hour window. This could indicate software installation, updates, or potentially malicious activity involving package management or configuration files.
Detects suspicious command-line activity involving utilities that contain 'checksum' or 'hash' in their command line, potentially indicating file integrity checks, malware analysis evasion, or credential dumping attempts. The rule triggers if five or more such commands are executed within an hour by the same account on the same computer.
This rule detects an unusually high volume of access attempts (20 or more within an hour) to a user's 'Documents' or 'Desktop' folders. This activity could indicate an adversary attempting to discover or collect sensitive data.
This rule detects a high volume of access attempts (10 or more within an hour) by a single user to sensitive system directories such as 'Admin' or 'System32'. This behavior could indicate an adversary performing file and directory discovery, attempting to access sensitive files, or staging for further malicious activity.
This rule detects the invocation of local AI/LLM CLI utilities (e.g., ollama, llama-cpp) by potentially malicious or automated parent processes. It specifically flags scenarios where non-interactive or scripting-based processes (such as WScript, PowerShell, or Python) attempt to use these AI tools, particularly when the command line includes keywords related to sensitive data discovery, such as 'password', 'token', or 'private key'. This behavior is characteristic of infostealer activity (e.g., QUIETVAULT) attempting to use AI tools for automated reconnaissance and credential extraction.
Detects cloud searches for credential, key, production, database, or confidential terms followed by access to matching files within OneDrive.
Detects the execution of common Linux binary inspection and utility tools (ldd, strings, readelf, objdump, nm) when referencing libssh2, potentially indicating an attacker's reconnaissance effort to analyze libraries for vulnerabilities or reverse engineer SSH-related functionality.
Detects the creation of files with filenames '.store' or '.host' (or any dot-prefixed file) within the Windows TEMP directory by specific processes (python.exe or chost.exe). This behavior is observed in certain npm-based Remote Access Trojans (RATs) to drop configuration and state files.
Detects the creation of files with filenames '.store' or '.host' (or any dot-prefixed file) within the Windows TEMP directory by specific processes (python.exe or chost.exe). This behavior is observed in certain npm-based Remote Access Trojans (RATs) to drop configuration and state files.
This rule detects when a non-Outlook process running as SYSTEM accesses or creates PST or OST mailbox data files. The logic specifically excludes legitimate Outlook, searchindexer, or searchprotocolhost activity to focus on suspicious mailbox collection sequences.
Detects the GIFTEDCROOK malware creating stable per-host identifiers and operational files within the Windows %TEMP% directory. This behavior indicates post-compromise activity, specifically the establishment of a tracking mechanism or local storage for operational logs and data by the malware.
Detects recursive file and directory discovery activity performed by common command-line utilities (dir, gci, find, ls) when initiated by suspicious parent processes such as interpreters (python, node, wscript) or shells, excluding processes signed by known trusted publishers.
Detects recursive file and directory discovery activity performed by common command-line utilities (dir, gci, find, ls) when initiated by suspicious parent processes such as interpreters (python, node, wscript) or shells, excluding processes signed by known trusted publishers.
Detects file creation, copy, or rename operations within known VPN application directories (CyberGhost, ExpressVPN, NordVPN) when initiated by Chromium Embedded Framework (CEF) related processes (CefSharp.BrowsersSubprocess). This behavior is highly irregular as standard web browser components should not be modifying the local configuration or installation directories of VPN software.
Detects reconnaissance activities associated with the MYRA RAT, specifically the enumeration of network connections by reading /proc/net/tcp and /proc/net/udp, originating from the systemd-userdbd process. This behavior is indicative of malware attempting to map network state via proc filesystem parsing.
Detects cloud searches for sensitive keywords (credential, secret, etc.) followed by access to matching files.
Page 13 of 31