Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
707 detections
Filters
Last updated
All Time
Detection languages
362
144
48
42
25
Contributors
209
170
72
54
41
Categories
485
297
189
112
77
Platforms
413
316
165
62
53
Products / Services
162
112
62
36
34
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
707
CVEs
5
5
4
3
2
IDS Classtypes
15
5
4
2
IDS Protocols
24
2
1
This rule detects attempts to extract credentials from FortiGate devices by targeting specific management API endpoints. It looks for HTTP GET requests to '/api/v2/cmdb/' followed by paths like 'system/admin', 'vpn.ssl.settings', or 'user/local', which are known to contain sensitive configuration or user data. This activity is associated with the 'FortiBleed' campaign and CVE-2026-24858.
Detects instances where common scripting runtimes (Python, Node.js) or development-related parent processes (e.g., VS Code, npm) access sensitive cloud credential or configuration files (AWS, Google Cloud, Azure). This behavior may indicate an adversary or an unauthorized script attempting to exfiltrate or leverage stored cloud credentials from an developer workstation.
Detects access to 'wallet.dat' files (commonly associated with cryptocurrency wallets) by processes with misleading or suspicious names running from user AppData directories. This behavior is indicative of credential theft or malware attempting to exfiltrate digital assets.
Infostealer distributed via fake open-source tool impersonation sites
Detects command-line activity searching for, accessing, or displaying sensitive credential and configuration files on Linux systems, such as AWS credentials, Kubernetes configurations, Docker settings, or application API keys. This behavior is indicative of credential theft or discovery attempts.
Detects unauthorized access to browser credential databases, cloud configuration files, and developer secret stores by processes spawned from Node.js or npm. This behavior is indicative of IronWorm and similar infostealers exploiting malicious npm package preinstall hooks to harvest sensitive developer credentials.
Detects Node.js processes spawning from common command-line shells (npm, cmd, bash) and accessing sensitive credential directories, such as '.claude' or Docker 'config.json'. This behavior is indicative of credential theft or unauthorized access attempts often associated with malicious npm packages or supply chain attacks.
Detects unauthorized access to sensitive credential files (Docker, AWS, npm, PyPI, GCloud) by Node.js processes, specifically when those processes are triggered by common npm lifecycle scripts like preinstall, postinstall, or peer dependency scripts. This is a common pattern observed in supply chain attacks involving malicious npm packages.
Detects Server-Side Request Forgery (SSRF) attempts targeting cloud provider metadata services (specifically GCP) or sensitive local files like '/proc/self/environ' using common bypass patterns and request structures. These requests typically originate from an application process attempting to access internal environment variables or cloud identity metadata.
Detects attempts by a Chrome web browser process to create, modify, or rename files associated with sensitive user credentials or application data, such as AWS credentials, browser logins, or environment configuration files. This behavior is indicative of credential theft or staging of sensitive information.
Detects when the node.js runtime process accesses Docker configuration files, which may contain sensitive authentication credentials or registry settings. This behavior is atypical for standard node.js applications and could indicate credential theft or unauthorized container environment interaction.
Detects Node.js runtime instances interacting with multiple sensitive developer configuration and credential files (e.g., .gitconfig, GitHub CLI host tokens, Claude configuration, git-credentials) in a single session. This pattern is consistent with infostealer malware (such as Miasma/MYRA) attempting to harvest developer credentials for downstream exploitation.
This rule detects potential unauthorized access to web browser data files (such as logins, cookies, and history databases) or specific registry modifications indicative of browser hijacking or credential theft. It monitors for processes other than known web browsers accessing sensitive browser configuration files or creating registry keys in HKCU that might be used for persistence or browser configuration manipulation.
Detects a Node.js process, spawned as a child of an IDE (e.g., VS Code, Cursor), that accesses local AWS configuration or credential files followed by an outbound network connection to a non-AWS destination. This behavior is indicative of potential cloud credential exfiltration via malicious Model Context Protocol (MCP) server execution.
Detects processes accessing sensitive files on a Linux system, such as SSH private keys, shell history files, and various application-specific configuration or credential files (e.g., Claude, Codex, Gemini, Cline, Opencode, Kilo). The rule excludes common system processes like shells, SSH daemons, git, and curl to minimize noise while identifying suspicious file access.
Detects the transmission of potential sensitive information, such as passwords, tokens, API keys, or private keys, within Microsoft Teams chat messages by matching message content against a regular expression pattern for common credential formats.
Cloud extortion group exploiting exposed credentials and storage
Detects credential harvesting behavior associated with the BQTLock (BaqiyatLock) malware, including the staging of password files in temporary directories, unauthorized access to browser credential stores (e.g., Login Data, key4.db), and the use of system utilities like vaultcmd.exe to interact with the Windows Credential Manager. It also monitors the execution of PyInstaller-packed loaders (BQT.exe or start.exe) from temporary directories.
Detects the execution of 'runas.exe' with the '/savecred' or '/netonly' parameters. The '/savecred' parameter allows the use of credentials previously stored in the credential manager, while '/netonly' allows the use of credentials for remote network resources without authenticating locally. Both flags can be abused by adversaries to persist or move laterally with compromised or cached credentials while evading local authentication monitoring. The rule excludes common system-signed processes originating from the Windows System32 directory.
Detects potential indicators of an SSH/PAM backdoor. This includes three behaviors: 1) SSH-related system processes writing to suspicious file paths (e.g., /tmp, /dev/shm, or hidden files in user directories), 2) PAM sessions immediately followed by suspicious file writes, and 3) successful SSH authentications for usernames previously reported as 'Invalid' by the system, suggesting a tampered PAM module allowing arbitrary authentication.
Monitors GitHub audit logs for suspicious or high-risk activities within CI/CD pipelines, including actions triggered by forks, workflow approvals, branch policy overrides, self-hosted runner registration, and sensitive secret access.
Page 20 of 34