Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
252 detections
Filters
Last updated
All Time
Detection languages
109
48
29
20
15
Contributors
70
34
30
21
11
Categories
156
65
58
54
31
Platforms
129
107
62
33
16
Products / Services
39
36
27
19
18
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
5
4
2
1
1
IDS Classtypes
4
3
1
1
IDS Protocols
8
This detection identifies network connections to specific malicious domains associated with the TeamPCP LiteLLM PyPI compromise (litellm 1.82.7 / 1.82.8). It specifically looks for connections originating from Python-related processes (python, python3, pip) to domains like 'models.litellm.cloud' or 'checkmarx.zone'. A match indicates potential compromise and warrants investigation into the affected host, user, and surrounding activity.
This detection identifies activity related to the TeamPCP Telnyx PyPI backdoor. It specifically looks for the installation of compromised 'telnyx' package versions (4.87.1 or 4.87.2) via pip, command-line interactions with a known C2 server (83.142.209.203:8080 for 'ringtone' or 'hangup' WAV files), or the presence of 'msbuild.exe' in the Windows Startup folder, which is an indicator of persistence used by this threat.
Detects ShadowSniff info-stealer based on strings, PDB path, and behavioral indicators.
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
This query detects multiple TTPs associated with the Storm-2561 campaign that uses SEO poisoning to distribute fake VPN clients for credential theft. It looks for known file hashes, a specific code-signing certificate, malicious DLL side-loading and C2 communication patterns.
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
Detects Node.js processes performing credential enumeration with patterns matching OtterCookie backdoor behavior targeting wallets, passwords, and keys.
This rule detects command-line access to cloud metadata services from utilities such as curl, wget, busybox, or python. It specifically looks for command lines containing IP addresses or hostnames commonly associated with cloud metadata endpoints (e.g., 169.254.169.254, metadata.google.internal, 100.100.100.200) or metadata paths (e.g., /latest/meta-data, /computeMetadata/v1/). This is a hunting rule designed to identify unusual process activity that might indicate a cloud-aware malware framework attempting to discover cloud environment details.
Detects network connections from the Claude Code CLI ('claude' or 'claude.exe') to a destination other than the official 'api.anthropic.com' endpoint. This indicates that the 'ANTHROPIC_BASE_URL' environment variable has likely been overridden by a malicious '.claude/settings.json' configuration file in an attempt to intercept and exfiltrate API keys, as described in CVE-2026-21852.
This rule detects suspicious code search queries within Azure DevOps audit logs that may indicate an adversary is attempting to find sensitive information such as passwords, API keys, tokens, or private keys. It specifically looks for keywords like 'password', 'secret', 'token', 'apikey', 'api_key', 'connectionstring', 'connstring', 'credential', 'private key', and 'BEGIN RSA PRIVATE KEY' in code search queries.
Detects when a Visual Studio Code process (Code.exe) or its underlying Node.js process accesses sensitive user directories or files. This could indicate the exploitation of a vulnerable extension, such as in CVE-2025-65717, to steal credentials or other sensitive data.
Detects execution of suspicious tools or commands that may indicate credential or secret discovery. Generic detection for processes attempting to enumerate credentials, secrets, or sensitive information across files, repositories, or environments.
This rule detects the presence or execution of known malicious infostealer files based on their SHA256 hash values or a specific filename pattern. The SHA256 hashes are associated with infostealer malware as referenced in a VirusTotal blog post. The filename pattern 'malwarebytes-windows-github-io' also indicates potential malicious activity, likely related to a deceptive download or execution.
Detects execution of TruffleHog, an open-source tool used to search repositories, files, and environments for secrets and credentials. Adversaries may use it to discover exposed credentials or sensitive information within source code or configuration files
Detects execution of different log query utilities and commands to search and dump the content of specific event logs or look for specific event IDs.
This technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc.
This technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc.
This KQL query identifies vulnerable VPN clients installed on endpoints that have High or Critical severity CVEs. VPN software is a high-value target for attackers because vulnerabilities can be exploited to bypass network access controls, intercept traffic, or gain remote access to internal networks.
Detects when a user has potentially entered their password into the username field during a failed Okta login attempt. This can lead to the password being retained in log files, posing a security risk.
Detects when a modification (create, update, replace, delete, or patch) action is taken that affects mutating or validating webhook configurations in Kubernetes. Adversaries can abuse these configurations to achieve persistence, exfiltrate credentials, or escalate privileges within the cluster.
Identifies when an admission controller is executed in GCP Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.
This rule identifies when an admission controller is executed in Azure Kubernetes. Admission controllers intercept and potentially modify requests to the Kubernetes API server. Adversaries can leverage admission webhooks (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) for persistence, such as injecting malicious containers into pods or intercepting API requests to steal credentials and sensitive information.
The analytic detects unauthorized access to Outlook credentials stored in the Windows registry. It leverages Windows Security Event logs, specifically EventCode 4663, to identify access attempts to registry paths associated with Outlook profiles. This activity is significant as it may indicate attempts to steal sensitive email credentials, which could lead to unauthorized access to email accounts. If confirmed malicious, this could allow attackers to exfiltrate sensitive information, impersonate users, or execute further unauthorized actions within Outlook, posing a significant security risk.
Page 10 of 12