Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
707 detections
Filters
Last updated
All Time
Detection languages
362
144
48
42
25
Contributors
209
170
72
54
41
Categories
485
297
189
112
77
Platforms
413
316
165
62
53
Products / Services
162
112
62
36
34
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
707
CVEs
5
5
4
3
2
IDS Classtypes
15
5
4
2
IDS Protocols
24
2
1
Detects malicious activity associated with npm supply chain compromise, including execution of known malicious npm lifecycle scripts, DNS queries to suspected C2 domains, and unauthorized access to sensitive developer credential files (such as .npmrc, .aws/credentials, and SSH keys) by Node.js processes.
Detects instances where JavaScript runtime processes (node, npm) execute specific peer-related or verification scripts and subsequently access sensitive system files or directories, such as SSH configurations, AWS credentials, or browser data, within a 5-minute window.
Detects the execution of the TruffleHog tool, which is used for scanning Git repositories and codebases to discover exposed sensitive information, such as API keys and passwords. The rule monitors process execution command lines and filters out common CI/CD and automation service accounts to identify potentially malicious or unauthorized use of the tool on endpoints.
Detects the execution of the TruffleHog tool, which is used for scanning Git repositories and codebases to discover exposed sensitive information, such as API keys and passwords. The rule monitors process execution command lines and filters out common CI/CD and automation service accounts to identify potentially malicious or unauthorized use of the tool on endpoints.
Detects the execution of 'runas.exe' with the '/savecred' or '/netonly' parameters. The '/savecred' parameter allows the use of credentials previously stored in the credential manager, while '/netonly' allows the use of credentials for remote network resources without authenticating locally. Both flags can be abused by adversaries to persist or move laterally with compromised or cached credentials while evading local authentication monitoring. The rule excludes common system-signed processes originating from the Windows System32 directory.
This rule monitors Linux authentication logs for anomalies related to Pluggable Authentication Modules (PAM). It identifies potential security risks by detecting file operations (read, write, create) within PAM-related processes, references to world-writable or temporary directories that may be used for staging credentials, and unusual authentication event patterns.
Detects two suspicious behaviors related to OpenSSH. The first scenario identifies unauthorized modifications, creations, or renames of core OpenSSH binaries (/usr/sbin/sshd, /usr/bin/ssh, /usr/bin/scp) that are not initiated by common package managers, which could indicate persistence mechanisms or backdooring. The second scenario monitors ssh/sshd/scp processes creating or modifying files in common temporary or world-writable directories (/tmp, /var/tmp, /dev/shm, etc.), which is often indicative of credential harvesting or data staging.
Detects the transmission of potential sensitive information, such as passwords, tokens, API keys, or private keys, within Microsoft Teams chat messages by matching message content against a regular expression pattern for common credential formats.
Detects unauthorized processes attempting to access or perform operations on sensitive files such as browser credentials, SSH keys, crypto wallets, and password manager databases. The rule specifically looks for non-standard or unsigned processes interacting with a high volume of these files in a short time frame, which is indicative of credential harvesting by infostealer malware like Lumma, Redline, or Vidar.
Monitors GitHub audit logs for suspicious or high-risk activities within CI/CD pipelines, including actions triggered by forks, workflow approvals, branch policy overrides, self-hosted runner registration, and sensitive secret access.
Detects instances where 'node.exe' accesses browser extension LevelDB directories (associated with cryptocurrency wallets in Chrome, Edge, or Brave) or executes with suspicious command-line arguments such as 'protocal.cjs', 'NodePackages', or 'nvmconf'. This behavior is indicative of potential malware attempting to exfiltrate sensitive browser data or execute malicious code.
Detects bash processes executing commands that combine AWS identity verification with outbound exfiltration using curl. The pattern specifically monitors for the use of 'aws sts get-caller-identity' followed by an immediate HTTP POST transmission of data (indicated by '-d @-'), which is characteristic of attackers exfiltrating captured cloud environment metadata or temporary credentials.
This rule detects potentially malicious child processes spawned by Amazon Q or AWS Language Server components (e.g., amazon-q, aws-lsp-server). The rule specifically flags behavior associated with the loading of MCP server configurations, potential unauthorized access to AWS credentials, or network data exfiltration attempts through commonly abused binaries like shell interpreters, python, or curl/wget when these are not signed by Amazon.
Detects instances where common development runtime processes (e.g., node, python, shells) spawn child processes whose command lines contain references to sensitive credential environment variables such as AWS access keys, GitHub tokens, or SSH authentication sockets. This behavior often indicates that a developer or an automated tool is insecurely passing credentials via command-line arguments to subprocesses.
Detects when common developer environments (IDE processes like VS Code or Node.js-based tools) or AI coding assistant tools (e.g., Amazon Q) spawn suspicious child processes (like shells or network tools) that interact with sensitive cloud configuration files, environment variables, or initiate unauthorized network requests.
Detects unauthorized access to sensitive credential and configuration files associated with AI development tools (Cursor, Claude, Gemini) and cloud providers (AWS, GCP) by the Miasma worm, which seeks to steal environment configuration and authentication data.
Detects anomalous credential exfiltration attempts by GitHub Actions runners. The rule monitors for runner child processes (printenv, env, set) attempting to access sensitive CI/CD variables, or networking tools (curl, wget) transmitting data to unauthorized external endpoints, consistent with Miasma worm behavior.
This rule detects potential credential harvesting activity associated with the Hannibal Stealer. It looks for non-standard processes (processes other than the browsers themselves) that access sensitive browser credential stores (like 'Login Data', 'cookies.sqlite', or 'key4.db') and correlate these file access events with the loading of 'bcrypt.dll' or 'CefSharp.BrowsersSubprocess.dll', which are often used for decryption or browser automation/sub-processes during credential theft.
Detects the use of the AWS CLI to extract Secrets Manager values and potentially STS tokens, writing them to local text files in the /tmp directory. This activity is indicative of an attacker attempting to exfiltrate credentials or sensitive information.
This rule detects suspicious command-line activity where shell interpreters (bash, sh, dash, python) are used to search for or interact with potentially sensitive system files, such as password files or custom indicators of compromise like 'evil_tenant'. The query targets grep, find, ls, and echo commands used to locate or confirm the existence of these sensitive artifacts.
Detects the use of wbadmin.exe to initiate a system backup that targets sensitive Active Directory and registry files (NTDS.dit, SYSTEM, and SECURITY hives) to a local SMB share on the loopback address. This technique is used by threat actors to stage critical credential material for offline extraction and cracking.
Page 22 of 34