Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
707 detections
Filters
Last updated
All Time
Detection languages
362
144
48
42
25
Contributors
209
170
72
54
41
Categories
485
297
189
112
77
Platforms
413
316
165
62
53
Products / Services
162
112
62
36
34
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
707
CVEs
5
5
4
3
2
IDS Classtypes
15
5
4
2
IDS Protocols
24
2
1
Detects scripted use of the macOS 'security find-generic-password' command targeting the Chrome Keychain item from a shell or unsigned temp-directory parent process, consistent with BlueNoroff's post-ClickFix Keychain master-key theft technique.
Detects a single unrecognized process combining two or more distinct PRO/ULTIMATE surveillance behaviors: webcam capture via Win32 Media Foundation, screenshot/screen-recorder file drops, and keystroke/clipboard dump file creation, within a short 15-minute window. Excludes known legitimate screen-recording, remote-support, and accessibility software.
Detects an unsigned or unrecognized process performing read or modification operations on multiple types of credential stores (SSH keys, cloud CLI configurations, and environment variable files) within a short time frame. This behavior is indicative of credential harvesting or unauthorized looting of secrets from a developer workstation, similar to techniques used by stealer malware.
Detects the creation of a file named 'logAzure.txt' that contains sensitive Microsoft Graph or cloud configuration credentials, such as TenantId, ClientId, ClientSecret, or UserEmail. This activity is indicative of credential staging or exfiltration by malicious actors.
Detects AWS credentials or config file reads by scripting engines (Python/Node/Ruby/etc.) excluding known AWS tooling, matching the mrmustard stealer's credential-theft behavior.
Detects the creation of a file named 'logAzure.txt' that contains sensitive Microsoft Graph or cloud configuration credentials, such as TenantId, ClientId, ClientSecret, or UserEmail. This activity is indicative of credential staging or exfiltration by malicious actors.
Detects regsvr32 loading chromelevator.ocx/mscom.ocx followed by the ChromEggscalator credential-extraction command sequence.
Detects the malicious GitHub Actions workflow that exfiltrates PyPI/Codecov CI secrets to the attacker's known webhook.site endpoint.
Detects unauthorized file access events targeting the Telegram Desktop AppData directory, which is a known technique for exfiltrating messenger session data and credentials. This rule filters for file access actions and is intended to exclude legitimate access by the Telegram application process itself.
Detects file access events for 'logAzure.txt', which is used by a specific implant to store RSA private keys for C2 payload decryption.
Detects the creation of a file named 'logAzure.txt' that contains sensitive Microsoft Graph or cloud configuration credentials, such as TenantId, ClientId, ClientSecret, or UserEmail. This activity is indicative of credential staging or exfiltration by malicious actors.
Detects the execution of tasks within Azure Container Registry that involve sensitive strings or potential credential-related patterns in the task configuration, such as 'secret-task', 'acb_step_0', or specific flag references, which may indicate testing or exploitation of container build pipelines.
Detects AWS credentials or config file reads by scripting engines (Python/Node/Ruby/etc.) excluding known AWS tooling, matching the mrmustard stealer's credential-theft behavior.
Detects suspicious activity associated with credential stealers where an unsigned or unrecognized process accesses MetaMask or Exodus wallet vault/seed files, performs process injection into legitimate browser/wallet binaries, or attempts to utilize DPAPI (CryptUnprotectData) or PBKDF2 for wallet credential decryption.
This rule monitors for suspicious activity often associated with credential or sensitive information discovery in development environments. It identifies: 1) Access to configuration files or directories related to AI-powered development tools (e.g., Cursor, Windsurf, Zed) which may store environment variables or API keys; 2) Network connections to common cloud instance metadata endpoints; and 3) Execution of command-line tools attempting to access AWS secrets or configuration management APIs (Secrets Manager, SSM).
Detects instances where the Node.js runtime environment (node.exe) accesses sensitive configuration, settings, or message control protocol (mcp) files within directories associated with common developer IDEs and text editors like Claude, Cursor, Windsurf, Zed, and VS Code. This activity may indicate an attempt to exfiltrate IDE configuration, API keys, or environment settings.
Detects Cisco device configuration lines containing weakly protected or plaintext credentials (Type 0 plaintext, Type 4 broken SHA-256, Type 7 Vigenere-cipher passwords) captured in syslog/config backup feeds. These weak hash types are trivially reversible and, once a router config is exfiltrated (e.g., via SNMP/TFTP abuse), allow rapid credential recovery and lateral movement.
This rule monitors container logs for attempts to access the Azure Instance Metadata Service (IMDS) via the 169.254.169.254 endpoint to request OAuth tokens or access Azure Key Vault secrets. Such activity within a containerized environment is often indicative of credential theft or discovery attempts by an adversary attempting to escalate privileges using the container's managed identity.
This rule monitors for processes making requests to cloud instance metadata services (GCP) or accessing sensitive secrets and parameters via AWS CloudTrail. Such activity may indicate an attacker attempting to enumerate instance identities, retrieve temporary security credentials, or access managed configuration secrets.
Detects file access events for 'logAzure.txt', which is used by a specific implant to store RSA private keys for C2 payload decryption.
Detects the use of container inspection tools such as 'dive' or 'docker inspect' to scan image layers or environment variables, specifically targeting the potential exfiltration of credentials or configuration secrets from container images or runtime environments.
Page 17 of 34