Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
707 detections
Filters
Last updated
All Time
Detection languages
362
144
48
42
25
Contributors
209
170
72
54
41
Categories
485
297
189
112
77
Platforms
413
316
165
62
53
Products / Services
162
112
62
36
34
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
707
CVEs
5
5
4
3
2
IDS Classtypes
15
5
4
2
IDS Protocols
24
2
1
Detects file access events for 'logAzure.txt', which is used by a specific implant to store RSA private keys for C2 payload decryption.
Detects Node.js processes executing with command-line arguments containing potential GitHub personal access tokens (PAT) or secrets while simultaneously initiating a network connection to the GitHub API. This behavior is indicative of potential credential abuse or automated exfiltration of sensitive tokens.
Detects execution of security utility commands on macOS intended to unlock a login keychain by providing a password via command line arguments. This behavior is indicative of an attempt to programmatically access stored credentials, which may be a precursor to credential theft.
Detects unauthorized access attempts to session files and account credentials stored locally by Discord, Telegram, and Steam applications, a behavior consistent with the CastleStealer malware.
Detects potential discovery of sensitive information (secrets) within container images by monitoring for the usage of 'dive' targeting private Azure Container Registry images or the use of 'docker inspect' to extract 'Config.Env' combined with 'grep' for the term 'secret'. This activity is often associated with reconnaissance for credential harvesting in containerized environments.
This rule detects potential information stealing activity by identifying either known StealC payload hashes or unauthorized processes spawned by PowerShell accessing web browser credential files (e.g., Login Data, Cookies, Local State). This is often associated with ClickFix or similar delivery mechanisms where an attacker uses PowerShell to stage sensitive browser data for exfiltration.
Detects read, creation, or modification events involving common cryptocurrency wallet files (e.g., wallet.dat) or directories associated with wallet applications (Exodus, Electrum, Ledger Live) located within user application support directories. This behavior is indicative of credential access attempts where an adversary is trying to steal private keys or wallet data.
Detects the use of the security command-line tool with the 'unlock-keychain' argument and the '-p' flag, which indicates an attempt to programmatically unlock a keychain, potentially using a supplied password.
This rule detects processes being executed that contain 'nacos' and 'token.secret.key' within their command-line arguments. This pattern is indicative of potential attempts to leverage or identify the default JWT secret key for an Apache Nacos deployment, which could allow an attacker to forge authentication tokens and gain unauthorized access.
Detects unauthorized access attempts to session files and account credentials stored locally by Discord, Telegram, and Steam applications, a behavior consistent with the CastleStealer malware.
This rule detects unauthorized or suspicious access attempts to a MinIO storage service by monitoring network traffic for default credentials, specific API calls like 'ListBuckets', or access to sensitive paths like 'terraform-state'. It triggers when traffic either targets the 'minio.internal' hostname or the local loopback address on port 9000, specifically looking for common MinIO administrative indicators.
Detects outbound web requests to OpenAI, Anthropic, or Google Gemini API endpoints that contain suspected API keys (OpenAI 'sk-proj-', Anthropic 'sk-ant-', or Google 'AIza' prefixes) in the request stream, potentially indicating hardcoded credentials, malicious script activity, or data exfiltration.
This rule monitors process command lines for strings associated with sensitive API keys (e.g., OpenAI, Alibaba, Huawei, Tencent, Aliyun) or seed phrases. It triggers an alert when two or more distinct patterns are identified on the same host, indicating potential credential harvesting or discovery activities.
Detects unauthorized access attempts to MinIO object storage using the default 'minioadmin' credentials. The rule specifically flags attempts to access sensitive files like 'terraform-state' or 'credentials.json' via HTTP GET requests.
Detects the creation or modification of Fortinet VPN-related configuration, command, or script files on a system. Attackers may target these files to gain unauthorized access, modify VPN parameters, or extract sensitive connection information.
Detects unauthorized attempts by low-privileged API tokens to access sensitive Argo CD endpoints related to Git repository credentials and project configurations. This rule specifically monitors for exploitation patterns associated with CVE-2025-55190, where tokens with read-only access could retrieve secrets they are not authorized to view.
Detects the execution of ADExplorer.exe with the command-line arguments to perform a snapshot export. AD Explorer is a legitimate administrative tool often abused by adversaries to perform offline NTDS.dit extraction or to enumerate Active Directory objects.
Detects instances where command-line arguments contain sensitive patterns such as cloud provider API keys, secret access keys, environment variable files, or cryptographic seed phrases. The rule specifically flags hosts where multiple such suspicious commands are executed, indicating potential reconnaissance or credential theft activity.
Detects unauthorized attempts to access or extract Redis credentials from the Argo CD repo-server process. The detection identifies suspicious command-line activity where environment variables are enumerated (via env or printenv) or sensitive configuration files (/etc/argocd) are accessed by the repo-server process or its children. This behavior is indicative of an attacker attempting to exploit unauthenticated gRPC vulnerabilities to steal credentials for cache poisoning or further lateral movement within a containerized environment.
Detects instances where a shell interpreter (bash or sh) accesses sensitive cloud and environment configuration files, specifically when initiated by parent processes associated with IDE-integrated development tools or AI assistants (claude, cursor, copilot-cli). This behavior suggests potential unauthorized access to credentials or environment variables.
Detects a process creating SQLite-style database files with random hex-like names within a randomly named subfolder of the Windows %TEMP% directory. This behavior, when correlated with file system access to specific cryptocurrency wallet directories (Electrum, Exodus, Ethereum, Coinomi), is consistent with Vidar information stealer staging activity.
Page 18 of 34