Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
707 detections
Filters
Last updated
All Time
Detection languages
362
144
48
42
25
Contributors
209
170
72
54
41
Categories
485
297
189
112
77
Platforms
413
316
165
62
53
Products / Services
162
112
62
36
34
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
707
CVEs
5
5
4
3
2
IDS Classtypes
15
5
4
2
IDS Protocols
24
2
1
Detects a shell/interpreter process spawned by a VS Code / VS Code-Insiders editor process that references CI marker environment variable names (GITHUB_, GITHUB_REPOSITORY, GITLAB_CI_, CI_PROJECT_PATH), matching how malicious Open VSX 'evil twin' extensions harvested CI/CD environment variables from GitHub, GitLab, and Azure DevOps runners.
This rule detects potential credential or sensitive file theft from VS Code extensions or configuration folders, followed closely by network exfiltration to the Telegram API. It specifically monitors file access to common paths (.ssh/id_rsa, .aws/credentials, .netrc, Local Storage, etc.) by VS Code processes, correlated with non-Telegram processes establishing network connections to api.telegram.org within a 10-minute window.
Detects process activity referencing GitHub Actions, GitLab CI, or Azure DevOps pipeline environment variable names (GITHUB_*, CI_*, GITHUB_ACTIONS, GITLAB_CI, Azure DevOps pipeline variables) consistent with a malicious extension harvesting CI/CD runner environment variables.
This rule detects macOS infostealer activity, such as AMOS, MacSync, or SHub, by identifying suspicious, correlated access to sensitive credential stores including the macOS Keychain, web browser credential databases (Chrome), SSH keys, and cryptocurrency wallet configuration files. It uses a combination of path/command-line strings and generic indicators of credential harvesting behavior.
Detects a Node or Bun process reading Kubernetes service account tokens or HashiCorp Vault
token files. The keyv/cacheable collector reads these paths directly as part of its credential
sweep. Companion rule to the IMDS detection (d02b7df0-60e3-4ec9-a077-339507299e11).
token files. The keyv/cacheable collector reads these paths directly as part of its credential
sweep. Companion rule to the IMDS detection (d02b7df0-60e3-4ec9-a077-339507299e11).
This rule detects potential credential or sensitive file theft from VS Code extensions or configuration folders, followed closely by network exfiltration to the Telegram API. It specifically monitors file access to common paths (.ssh/id_rsa, .aws/credentials, .netrc, Local Storage, etc.) by VS Code processes, correlated with non-Telegram processes establishing network connections to api.telegram.org within a 10-minute window.
Detects suspicious cross-process memory access or memory-dump activity targeting chrome.exe, consistent with extraction of the Security Domain Secret (SDS) master key or wrapped identity/UV private keys used to decrypt synced passkey credentials (Golden Pass-ta-key attack). Excludes known legitimate crash-dump and diagnostic tooling (WerFault, crashpad_handler, procdump, Chrome itself).
Possible O365 credential exfil via HTTP PUT to attacker-controlled S3 bucket
Detects privileged Active Directory enumeration seen on the wire by Corelight, filtered to source hosts that don't appear in the Cortex endpoint inventory. It reads ldap_search records from corelight_zeek_raw, tiers them by the LDAP filter (CRITICAL for credential-attribute and DCSync hunting, HIGH for Tier Zero, Kerberoast, delegation, and UAC-bitmask targeting, MEDIUM for broad group, computer, and GPO enumeration), then joins the source address against endpoints and keeps only the queries whose id_orig_h has no matching managed agent
Detects Python worker processes (e.g., dataset converters) spawning suspicious child processes (shells, network tools) or accessing sensitive filesystem paths/endpoints, such as Kubernetes service account tokens or cloud instance metadata, which are often indicative of post-exploitation activity following an SSTI or code injection vulnerability.
Detects privileged Active Directory enumeration seen on the wire by Corelight, filtered to source hosts that don't appear in the Cortex endpoint inventory. It reads ldap_search records from corelight_zeek_raw, tiers them by the LDAP filter (CRITICAL for credential-attribute and DCSync hunting, HIGH for Tier Zero, Kerberoast, delegation, and UAC-bitmask targeting, MEDIUM for broad group, computer, and GPO enumeration), then joins the source address against endpoints and keeps only the queries whose id_orig_h has no matching managed agent
This rule detects a potential credential exfiltration attempt following the launch of a terminal (cmd.exe, powershell.exe, bash, zsh, sh) by common IDE processes (Code.exe, Cursor.exe, Antigravity.exe). It monitors for sensitive configuration or credential files (such as .env, .aws/credentials, or .config/gh) being accessed within two minutes of a terminal process being spawned by the development environment.
Detects suspicious cross-process memory access or memory-dump activity targeting chrome.exe, consistent with extraction of the Security Domain Secret (SDS) master key or wrapped identity/UV private keys used to decrypt synced passkey credentials (Golden Pass-ta-key attack). Excludes known legitimate crash-dump and diagnostic tooling (WerFault, crashpad_handler, procdump, Chrome itself).
This rule detects a potential credential exfiltration attempt following the launch of a terminal (cmd.exe, powershell.exe, bash, zsh, sh) by common IDE processes (Code.exe, Cursor.exe, Antigravity.exe). It monitors for sensitive configuration or credential files (such as .env, .aws/credentials, or .config/gh) being accessed within two minutes of a terminal process being spawned by the development environment.
SYSVOL / NETLOGON Enumeration
Cortex XDR
Every authenticated principal in the domain can read SYSVOL, and SYSVOL routinely stores logon scripts, scheduled-task XML, and GPP files that contain plaintext or reversibly-encrypted credentials. Adversaries recursively enumerate SYSVOL to harvest these — either grepping file contents (Select-String 'password') or matching file names (dir *password*). This rule detects the read-access footprint of that enumeration on the DC itself, independent of the tool or command line used, by counting distinct SYSVOL paths accessed by a single non-machine account in a short window. Default threshold is 100, change to a high volume for your environment
Detects file creation, modification, or rename activity targeting known directory paths and files used by the AMOS (Atomic macOS Stealer) to stage exfiltrated credentials, cryptocurrency wallets, and browser data. It identifies staging activity by looking for patterns associated with the stealer's data-collection routines.
Detects unauthorized file system access to sensitive Gitea configuration files (app.ini) or internal directories (custom/conf, data/tmp) by the gitea/git service account. This pattern is indicative of post-exploitation credential or secret harvesting following remote code execution vulnerabilities, such as the diffpatch git hook RCE (CVE-2026-60004).
SYSVOL / NETLOGON Enumeration
Cortex XDR
Every authenticated principal in the domain can read SYSVOL, and SYSVOL routinely stores logon scripts, scheduled-task XML, and GPP files that contain plaintext or reversibly-encrypted credentials. Adversaries recursively enumerate SYSVOL to harvest these — either grepping file contents (Select-String 'password') or matching file names (dir *password*). This rule detects the read-access footprint of that enumeration on the DC itself, independent of the tool or command line used, by counting distinct SYSVOL paths accessed by a single non-machine account in a short window. Default threshold is 100, change to a high volume for your environment
Detects the use of the netsh.exe utility with the 'wlan show profile' command and the 'key=clear' argument, which displays saved Wi-Fi network passwords in plaintext. This technique is often used by adversaries to perform credential harvesting on compromised systems.
Detects file access/read of the in-cluster Kubernetes service account token path or a user's kubeconfig file by a non-standard binary (e.g. scripting interpreter, shell, or network utility) rather than known Kubernetes/orchestration tooling. Narrowed to reduce false positives from legitimate kubectl, helm, kubelet, and container runtime processes that routinely read these credentials.
Detects a cloud CLI sign-in (Azure CLI, AWS CLI, gcloud, Google Cloud SDK) from an IP address never previously seen for the user within the prior 30 days AND exhibiting anomalous geolocation or impossible travel relative to the user's last known sign-in location, occurring within a defined window of a related endpoint-compromise or credential-theft alert for the same user. Known corporate egress IPs, VPN exit nodes, and recognized traveling employees are excluded, a pattern consistent with use of credentials stolen by an infostealer to access cloud resources via command-line tools.
Page 16 of 34