Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
707 detections
Filters
Last updated
All Time
Detection languages
362
144
48
42
25
Contributors
209
170
72
54
41
Categories
485
297
189
112
77
Platforms
413
316
165
62
53
Products / Services
162
112
62
36
34
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
707
CVEs
5
5
4
3
2
IDS Classtypes
15
5
4
2
IDS Protocols
24
2
1
Detects a spike in successful operations related to Azure Storage Account Keys by a single caller within a one-hour window. This could indicate an adversary attempting to enumerate, access, or exfiltrate storage account keys, or a legitimate user performing multiple key management activities.
This rule detects potential unauthorized access to Azure Storage Blobs following the retrieval of storage account access keys. It correlates 'ListKeys' API events with subsequent blob access activities from either unrecognized IP addresses or via Shared Access Signature (SAS) tokens, indicating potential credential misuse.
Detects the transmission of potential sensitive information, such as passwords, tokens, API keys, or private keys, within Microsoft Teams chat messages by matching message content against a regular expression pattern for common credential formats.
Detects suspicious process activity originating from common build and package management tools (node, npm, bun, npx) that targets sensitive cloud and container credential locations, such as AWS IMDS, AWS configuration files, Kubernetes service account tokens, and HashiCorp Vault secrets. This rule is designed to identify malicious post-installation scripts or build processes attempting to exfiltrate credentials from developer or CI/CD environments.
Detects attempts to access browser credential stores or LSASS process memory by unexpected processes. This rule identifies suspicious file access patterns to browser login data files (Chrome, Edge, Firefox, Brave) by non-browser executables, as well as unauthorized access to LSASS process memory via Sysmon Event ID 10 or Windows Security Event 4656 by non-system processes. These activities are indicative of credential dumping or theft.
Detects attempts by explorer.exe to access browser credential and cookie files from common web browsers (Chrome, Edge, Firefox). This activity is highly suspicious as explorer.exe is not typically involved in legitimate access to these sensitive files, suggesting potential credential theft or reconnaissance.
Detects unauthorized processes (Python, Node.js) accessing sensitive files such as browser login data, cookie stores, wallet files, and SSH/AWS keys, which are common indicators of credential theft and data exfiltration.
Detects instances where scripting or development processes (e.g., node.exe, python.exe, code.exe) access sensitive SSH private key files or PEM files, followed by an immediate outbound network connection to a non-private IP address within 60 seconds. This activity is indicative of credential exfiltration or unauthorized use of stolen keys.
Detects unauthorized processes attempting to access or perform operations on sensitive files such as browser credentials, SSH keys, crypto wallets, and password manager databases. The rule specifically looks for non-standard or unsigned processes interacting with a high volume of these files in a short time frame, which is indicative of credential harvesting by infostealer malware like Lumma, Redline, or Vidar.
Detects GitHub Actions runner processes (e.g., node, bash, python) accessing sensitive CI/CD environment variables (GITHUB_TOKEN, NPM_TOKEN) followed within 30 seconds by an outbound network connection to a non-GitHub domain. This pattern is indicative of potential secret exfiltration by compromised CI/CD pipelines or malicious build steps.
This rule detects network connections where an 'access_token=' string is present in the additional fields of network events, excluding common legitimate authentication domains like Google, Microsoft, and GitHub. This could indicate the exposure of sensitive access tokens over the network.
Detects anomalous processes targeting modern AI developer credential files and configuration files for tools like Claude, Gemini, and Cursor, a behavior exhibited by IronWorm.
Detects malicious behavior attributed to the Miasma/TonRAT malware, specifically targeting node.js or bun.exe runtime environments. The rule identifies suspicious network connections to command and control (C2) domains, access to sensitive developer credential files (e.g., .npmrc, .aws/credentials), execution of identified credential-harvesting functions in process command lines, and the execution of specific suspicious preinstall scripts.
Detects execution of AWS CLI subcommands used for credential or identity enumeration (e.g., sts get-caller-identity, iam get-user) when spawned from Amazon Q-related or development environment processes (Node.js/VS Code). This behavior is indicative of potential malicious activity involving a compromised MCP server configuration file (CVE-2026-12957).
Detects the Amazon Q Developer language server or extension host spawning suspicious child processes (bash, sh, zsh, python, node) that execute commands involving AWS STS identity retrieval, external data exfiltration via network tools like curl/wget, or direct references to AWS credential environment variables. This pattern is indicative of potential Remote Code Execution (RCE) via malicious Model Context Protocol (MCP) auto-execution.
USB worm and loader leveraging living-off-the-land binaries
Detects anomalous process behavior characterized by rapid access to multiple sensitive credential files or enumeration of critical environment variables (e.g., cloud, AI, or cryptocurrency wallet keys). This behavior aligns with the mass credential harvesting techniques observed in the IronWorm/Shai-Hulud campaign.
Detects instances where a non-standard browser process accesses sensitive browser credential files (e.g., Login Data, Cookies, key4.db) and simultaneously establishes a network connection to Discord or transmits data to a Discord webhook. This pattern is consistent with infostealer malware attempting to exfiltrate cached credentials via external services.
Detects instances where 'node.exe' accesses browser extension LevelDB directories for Chrome, Edge, or Brave, or executes with suspicious command-line arguments such as 'protocal.cjs', 'NodePackages', or 'nvmconf'. This behavior can indicate attempts to exfiltrate sensitive browser data or establish persistence, potentially associated with supply chain attacks or backdoors.
Detects node.exe processes accessing sensitive AWS configuration files (credentials, config), .npmrc files, or suspicious data parsing utilities, indicative of the Polymarket Trap npm infostealer attempting to exfiltrate cloud credentials and tokens from developer workstations.
Detects node.exe (Node.js runtime) process initiating file read operations on sensitive files such as SSH keys, AWS credentials, Docker configuration files, GPG keyrings, or package manager configuration files (npmrc/pypirc). This behavior is characteristic of malicious npm packages or infostealers attempting to exfiltrate developer credentials, as observed in the Polymarket Trap supply chain campaign.
Page 21 of 34