Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
707 detections
Filters
Last updated
All Time
Detection languages
362
144
48
42
25
Contributors
209
170
72
54
41
Categories
485
297
189
112
77
Platforms
413
316
165
62
53
Products / Services
162
112
62
36
34
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
707
CVEs
5
5
4
3
2
IDS Classtypes
15
5
4
2
IDS Protocols
24
2
1
Detects access to sensitive GCP credential-related files or the presence of credential-related environment variables/secrets in command lines and network request bodies. This pattern is often associated with the theft of service account keys or environment-based cloud credentials, frequently seen in serverless or containerized environments.
This rule detects two suspicious behaviors associated with OpenSSH components: the direct modification or replacement of critical OpenSSH binaries (/usr/sbin/sshd, /usr/bin/ssh, /usr/bin/scp), or the use of these processes to write files to suspicious or non-standard locations (such as /tmp/ or unauthorized subdirectories within /var/log/), which may indicate credential harvesting or the presence of a backdoor.
Detects when common web browsers (chrome.exe, msedge.exe, brave.exe, electron.exe) access local files that appear to contain sensitive credentials, secrets, tokens, or API keys based on file naming conventions and directory structures.
Detects when common web browsers (chrome.exe, msedge.exe, brave.exe, electron.exe) access local files that appear to contain sensitive credentials, secrets, tokens, or API keys based on file naming conventions and directory structures.
Detects when common web browsers (chrome.exe, msedge.exe, brave.exe, electron.exe) access local files that appear to contain sensitive credentials, secrets, tokens, or API keys based on file naming conventions and directory structures.
This rule detects file access or modification events targeting '.env' files, which often store environment variables and sensitive configuration data (such as API keys and credentials). The detection specifically focuses on file paths associated with CI/CD build agents, runners, or workspace directories (e.g., github, gitlab, jenkins, build, runner), where such credentials are high-value targets for attackers seeking to escalate access or pivot within an environment.
This rule detects file access or modification events targeting '.env' files, which often store environment variables and sensitive configuration data (such as API keys and credentials). The detection specifically focuses on file paths associated with CI/CD build agents, runners, or workspace directories (e.g., github, gitlab, jenkins, build, runner), where such credentials are high-value targets for attackers seeking to escalate access or pivot within an environment.
This rule detects suspicious activity involving Node.js or Bun runtimes, specifically focusing on the access of sensitive configuration files (e.g., .npmrc, .aws/credentials, .ssh, .kube/config) or the execution of commands containing keywords associated with credential harvesting and automated data collection scripts.
Detects rapid access (three or more distinct files within a 60-second window) to sensitive files typically containing credentials or configuration data (e.g., SSH keys, AWS credentials, environment files, container configurations). This pattern is often associated with credential dumping or reconnaissance activity by an adversary attempting to harvest secrets.
Detects instances where 'node' or 'bun' runtime processes access multiple sensitive developer configuration or credential files (e.g., .ssh, .aws/credentials, .npmrc, .kube/config). This behavior is indicative of potential credential theft or reconnaissance activities by an adversary attempting to leverage developer environments.
Detects the execution of common command interpreters (node, python, shell) or processes with 'mcp' in the command line that reference sensitive cloud-related environment variables or identity-related commands, such as AWS access keys, session tokens, or SSH authentication sockets. This indicates potential credential theft or unauthorized cloud resource access.
Detects instances where node.exe processes attempt to access sensitive configuration files, specifically AWS credential or configuration files, or .env files associated with common package installation or session management operations. This behavior may indicate an attempt to exfiltrate credentials from a developer or build environment.
Detects a single process reading both SSH private keys and various developer-sensitive configuration or credential files (e.g., .aws/credentials, .npmrc, .pypirc) on a single host. This behavior is consistent with infostealer activity, such as the Miasma JavaScript infostealer used in supply chain campaigns, aiming to harvest credentials from developer workstations.
Detects Node.js processes (node, npm) attempting to access sensitive files typically associated with web browser extensions, cryptocurrency wallets, or stored secrets. This activity is indicative of credential theft or data exfiltration attempts.
Detects instances where a node.exe process accesses common configuration, credential, or authentication files. Adversaries may leverage Node.js scripts or malicious applications to exfiltrate sensitive data such as SSH keys, AWS credentials, Docker configurations, or git configurations.
Detects instances where Node.js, npm, or npx processes attempt to access sensitive configuration files including AWS credentials, Claude API keys, or .env files, which is a common behavior of the Miasma infostealer used in supply chain compromise campaigns to harvest cloud and AI secrets.
Detects node.js processes spawned from npm postinstall hooks accessing developer credential files including .gitconfig, .npmrc, and GitHub CLI token files, consistent with the Operation Friday Harvest infostealer campaign targeting Claude Code, GitHub CLI, and npm tokens via malicious npm packages.
This rule detects when non-FileZilla processes attempt to read or access sensitive FileZilla configuration files, specifically 'recentservers.xml' or 'sitemanager.xml', which are known to store plain-text credentials for site connections. This behavior is indicative of credential harvesting.
Detects instances where a GitHub Actions runner requests an OIDC token and subsequently executes an npm publish command within 5 minutes. This behavior is indicative of unauthorized package deployment, potentially exploiting GitHub's OIDC 'trusted publishing' mechanism, as observed in the Miasma worm campaign.
Detects unauthorized access, creation, or modification of sensitive credential and token files (e.g., OAuth tokens, AWS credentials, gcloud tokens) in common user directories like AppData or .config by processes other than established browsers or legitimate cloud CLI tools. This behavior is indicative of credential theft or SaaS pivot attacks.
Detects unauthorized or non-standard processes attempting to create, modify, or access sensitive cloud configuration and credential files, such as AWS credentials, Azure CLI token caches, or GCP application default credentials. This behavior is indicative of potential credential theft or unauthorized access to cloud environment tokens.
Page 24 of 34