Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
707 detections
Filters
Last updated
All Time
Detection languages
362
144
48
42
25
Contributors
209
170
72
54
41
Categories
485
297
189
112
77
Platforms
413
316
165
62
53
Products / Services
162
112
62
36
34
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
707
CVEs
5
5
4
3
2
IDS Classtypes
15
5
4
2
IDS Protocols
24
2
1
Detects attempts to bypass authentication on Nacos servers, including the use of spoofed Nacos-Server User-Agent headers, suspicious API query patterns missing required access tokens, and the subsequent use of forged JWT tokens signed with default keys.
Detects attempts to bypass authentication on Nacos servers, including the use of spoofed Nacos-Server User-Agent headers, suspicious API query patterns missing required access tokens, and the subsequent use of forged JWT tokens signed with default keys.
Detects attempts to bypass authentication on Nacos servers, including the use of spoofed Nacos-Server User-Agent headers, suspicious API query patterns missing required access tokens, and the subsequent use of forged JWT tokens signed with default keys.
Detects high-volume image pull activity against an Azure Container Registry from a single identity, which may indicate reconnaissance or mass harvesting of container images to extract embedded credentials, secrets, or source code.
This rule detects the use of common command-line utilities (grep, find, bash, sh, awk) to search for sensitive files, such as SSH keys, configuration files containing credentials, or password-related patterns. The rule includes exclusions for common administrative, security, and backup tools that might legitimately perform such scans.
This rule detects the use of common command-line utilities (grep, find, bash, sh, awk) to search for sensitive files, such as SSH keys, configuration files containing credentials, or password-related patterns. The rule includes exclusions for common administrative, security, and backup tools that might legitimately perform such scans.
Detects access to Gitea secrets and configuration (app.ini, JWT secrets, SSH host keys, deploy keys) via file writes/renames or process command lines referencing those paths alongside Gitea, matching the secret-extraction tradecraft observed in the Red Heron campaign.
Detects unauthorized processes accessing sensitive web browser files (login data, cookies, local state) from suspicious or non-standard paths. This is a common behavioral pattern for infostealers attempting to exfiltrate user credentials and browser session tokens.
Detects instances where an Artifactory process or user accesses highly sensitive configuration files (system.yaml, join.key) or API endpoints containing configuration data, followed closely (within 15 minutes) by an outbound network connection to a non-standard or external destination. This pattern is indicative of a potential credential theft attempt targeting the Artifactory join key, which is used to authenticate Artifactory nodes in a cluster, followed by potential data exfiltration or C2 communication using these credentials.
Detects anomalous cloud authentication events occurring within a 3-hour window after suspected unauthorized access to sensitive configuration or credential files on a Vite development server. The rule flags sign-ins with high risk, anomalous location, or missing device compliance information, excluding trusted corporate locations and devices, serving as an indicator of potential post-exfiltration account takeover.
Detects attempts to access sensitive files like environment variables (.env), cloud provider credentials (AWS/Azure), or Terraform state files via a web server interface, specifically targeting Vite development server deployments.
This rule detects inbound HTTP requests targeting a Vite development server that attempt to access the '.env' configuration file via the '//@fs/' path, which is a known technique for sensitive file exposure in misconfigured Vite environments.
This rule detects inbound HTTP requests targeting a Vite development server that attempt to access the '.env' configuration file via the '//@fs/' path, which is a known technique for sensitive file exposure in misconfigured Vite environments.
This rule detects inbound HTTP requests targeting a Vite development server that attempt to access the '.env' configuration file via the '//@fs/' path, which is a known technique for sensitive file exposure in misconfigured Vite environments.
Detects unauthorized processes accessing sensitive web browser files (login data, cookies, local state) from suspicious or non-standard paths. This is a common behavioral pattern for infostealers attempting to exfiltrate user credentials and browser session tokens.
This rule detects unauthorized or suspicious access to sensitive configuration and credential files (e.g., .aws, .azure, .ssh) by specific DLP (Data Loss Prevention) or automation scripts, and identifies subsequent attempts to expose environment variables or sensitive tokens within process command lines.
Detects GitLab CI/CD pipeline configuration (.gitlab-ci.yml) that sets job artifacts to 'untracked: true' with 'when: always', which publishes every untracked file as a downloadable CI artifact -- the exact misconfiguration that exposed the leaked GitLab token in the GnuTLS incident.
Detects unreviewed commits to .gitlab-ci.yml that alter how the gitlab-triage tool invokes the sensitive API_TOKEN variable, with no associated merge request.
Detects instances where an Artifactory process or user accesses highly sensitive configuration files (system.yaml, join.key) or API endpoints containing configuration data, followed closely (within 15 minutes) by an outbound network connection to a non-standard or external destination. This pattern is indicative of a potential credential theft attempt targeting the Artifactory join key, which is used to authenticate Artifactory nodes in a cluster, followed by potential data exfiltration or C2 communication using these credentials.
Detects high-frequency requests to the RubyGems legacy API key endpoint, which may indicate attempts to harvest or bruteforce developer API keys. The rule specifically monitors for request patterns involving variations like .yaml, .json, or parameter-based variants often observed in scanning activities.
Detects high-frequency requests to the RubyGems legacy API key endpoint, which may indicate attempts to harvest or bruteforce developer API keys. The rule specifically monitors for request patterns involving variations like .yaml, .json, or parameter-based variants often observed in scanning activities.
Page 10 of 34