Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
707 detections
Filters
Last updated
All Time
Detection languages
362
144
48
42
25
Contributors
209
170
72
54
41
Categories
485
297
189
112
77
Platforms
413
316
165
62
53
Products / Services
162
112
62
36
34
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
707
CVEs
5
5
4
3
2
IDS Classtypes
15
5
4
2
IDS Protocols
24
2
1
Detects access to the AWS CLI credentials file (~/.aws/credentials) in a user's home directory, used by CISA's red team to harvest long-lived static IAM access keys.
Detects access to sensitive credential and configuration files commonly used by developers and automated systems, such as AWS credentials, SSH keys, Docker configurations, NPM tokens, and Maven settings. Access to these files is a high-indicator of credential harvesting by malicious actors or stealer-type malware.
Detects access to files containing cleartext credentials on an administrative workstation, followed by their use to authenticate to a sensitive business system — the initial-access path CISA's red team used against SBS 1.
Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Detects file creation, modification, or rename activity involving filenames that contain credential related indicators. The detection focuses on common document, spreadsheet, text, PDF, and archive formats that are frequently used to store sensitive authentication material. Such files may represent exposed credentials that could be leveraged by adversaries for credential access, privilege escalation, or lateral movement following endpoint compromise.
This rule monitors the execution of the Outlook process (olk.exe) where the command line contains the argument 'upn='. This pattern is often associated with the manual invocation of Outlook components or potential credential manipulation, as user principal names (UPNs) are frequently used in authentication workflows and may be targeted or misused.
Detects access to SQL developer tool configuration files (connections.json, product-preferences.xml) followed by a decryption utility, used by CISA's red team to recover cleartext database credentials from a targeted workstation.
MacSync Stealer (formerly known as Mac.c) is a macOS information stealer offered as a Malware-as-a-Service (MaaS). On May 5, 2026, researchers identified a new C2 domain (jacksonvillemma[.]com) delivering the malware's Stage 2 loader. Notably, this new infrastructure was active just days after the operator's previous C2 domain was publicly exposed, highlighting the threat actor's agility in rotating their delivery architecture.
Detects a non-browser process directly querying the Chrome/Brave/Edge SQLite Login Data store with the exact origin_url/username_value SELECT statements used by the botking RAT to harvest saved credentials.
Detects access attempts to credential files, private keys, and secrets (id_rsa, credentials.json, .pem, etc.).
Detects file system access to the ProtonVPN local configuration directory. This directory may contain sensitive data, such as cached credentials or session information, which could be targeted by unauthorized actors to facilitate credential theft or session hijacking.
Detects binaries embedding both the hardcoded AES-128-GCM key 'i am botking' and the embedded RSA-2048 private key used for C2 command authentication
Detects silent theft of Apple Notes data via sudo -S cat against NoteStore.sqlite and its -wal/-shm companions from a non-Notes-app process, a technique AmnesiaStealer uses to avoid triggering a TCC prompt.
Detects browser cookie theft via a cloned Chrome profile directory, CDP-based cookie export, and/or SQLite re-encryption of the cookie database using an attacker-known Safe Storage password, as used by AmnesiaStealer's streaming module.
Detects access to the FileZilla RecentServers.xml file, which contains historical server connection information. Attackers frequently target this file to extract stored FTP credentials, hostnames, and usernames for lateral movement or data exfiltration.
Detects the Screen Sharing file-copy helper (SSFileCopySender/SSFileCopyReceiver) running as UID 0/GID 80 while the connected session user is non-root/non-admin, indicating abuse of the arbitrary root file read/write primitive.
Detects instances where AI coding assistants (e.g., Cursor, Claude, Copilot) are observed interacting with specific configuration or sensitive files and subsequently initiating suspicious shell commands. The rule correlates file read activity (containing keywords like 'skill', 'preflight', '.ssh', or '.aws') followed closely by execution of potentially malicious commands like 'whoami /priv', credential decoding, or registry exploration, indicating potential abuse of the assistant's context.
Detects potential exposure or use of cloud, source-control, and AI API credentials through sensitive files and process command lines.
Detects curl POSTing hardcoded username/password-style credentials to a /login endpoint on a known tunnel domain (ngrok, Cloudflare Quick Tunnel, or localhost.run), indicating credential submission to an attacker-exposed tunnel endpoint.
Detects curl POSTing hardcoded username/password-style credentials to a /login endpoint on a known tunnel domain (ngrok, Cloudflare Quick Tunnel, or localhost.run), indicating credential submission to an attacker-exposed tunnel endpoint.
Detects instances where AI coding assistants (e.g., Cursor, Claude, Copilot) are observed interacting with specific configuration or sensitive files and subsequently initiating suspicious shell commands. The rule correlates file read activity (containing keywords like 'skill', 'preflight', '.ssh', or '.aws') followed closely by execution of potentially malicious commands like 'whoami /priv', credential decoding, or registry exploration, indicating potential abuse of the assistant's context.
Page 15 of 34