Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
707 detections
Filters
Last updated
All Time
Detection languages
362
144
48
42
25
Contributors
209
170
72
54
41
Categories
485
297
189
112
77
Platforms
413
316
165
62
53
Products / Services
162
112
62
36
34
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
707
CVEs
5
5
4
3
2
IDS Classtypes
15
5
4
2
IDS Protocols
24
2
1
Detects unauthorized processes reading, creating, or modifying sensitive files associated with local AI development tools and assistants (e.g., Claude, Codex, Gemini, Cline, Opencode, Kilo). This rule monitors for file operations outside of the known, legitimate AI tool processes, suggesting potential credential theft or configuration tampering by malicious software.
Detects the Djinn Stealer malware accessing sensitive configuration files and credential stores related to AI coding assistants (e.g., Claude, Codex, Gemini, Cline) and common development utilities (e.g., AWS, GKE, SSH) on Linux workstations. It also detects the creation of a 'linux-process-env.json' file, which is an artifact used by the stealer to exfiltrate environment variables harvested from process memory.
Detects potential credential theft (e.g., InvisibleFerret/BeaverTail malware) where a node.js or python process, spawned as a child process of VS Code (Code.exe), attempts to read sensitive cloud credential files for AWS, Azure, or GCP.
This rule detects unauthorized or unexpected processes accessing sensitive local files containing cloud provider credentials, configuration, or environment variables. It identifies access to files such as .aws/credentials, .azure/accessTokens.json, .npmrc, and .env by processes that are not recognized cloud CLI tools. The rule prioritizes alerts involving developer-oriented applications like VS Code or Node.js, which may indicate credential theft or compromise of a developer's workstation environment.
Detects the infostealer scraping .git-credentials or .git/config specifically targeting GitHub Personal Access Tokens (PATs). The rule identifies file access events where the file name is '.git-credentials' or 'config' within a folder path containing '.git', and the initiating process is 'python.exe'.
Detects access or modification attempts to KeePass (.kdbx) password database files by processes other than authorized KeePass applications. This behavior often indicates an attempt to exfiltrate or crack credential stores.
Detects unauthorized access to web browser sensitive files, including credential stores, cookies, and local state files, by processes other than standard browsers or their update mechanisms. This rule also flags access to specific staging directories or archive files associated with known malicious activity.
Detects potential credential theft activity where a user or compromised process executes shell commands to inspect environment variables, AWS credential files, or project configuration files (e.g., .env) for sensitive secrets such as API keys and access tokens.
Detects unauthorized access to KeePass database (.kdbx) and VPN configuration (.ovpn) files by processes originating from the C:\ProgramData\ directory. This behavior aligns with the activity of the GIFTEDCROOK information stealer observed during UAC-0226 campaigns, where malicious payloads are executed from staging folders within ProgramData.
Detects path traversal exploitation attempts targeting Dell Wyse Management Suite (WMS) processes or Java components, specifically looking for attempts to access sensitive system files such as SAM, NTDS.dit, or registry hive files via directory traversal sequences.
Detects Python accessing AWS, Azure, Google Cloud, Kubernetes, Docker, Terraform, or Vault credential stores. This rule specifically looks for Python processes executing commands that contain keywords associated with cloud CLI credential files or configuration paths.
This rule detects Node.js or Bun processes interacting with sensitive configuration, credential, or authentication files, or executing processes with specific, suspicious command-line markers associated with malicious behavior (e.g., Miasma). This is often indicative of credential theft or discovery activities by an attacker leveraging script interpreters.
This rule detects Node.js or Bun processes interacting with sensitive configuration, credential, or authentication files, or executing processes with specific, suspicious command-line markers associated with malicious behavior (e.g., Miasma). This is often indicative of credential theft or discovery activities by an attacker leveraging script interpreters.
This rule detects when an unusual process (not Outlook, MSOIA, OLK, or MicrosoftEdgeUpdate) queries registry keys associated with Microsoft Outlook profiles or the Windows Messaging Subsystem profiles. This activity could indicate an attempt to discover or access Outlook configuration, potentially for credential harvesting or data exfiltration.
Correlates the execution of a script from a cloned repository accessing developer credential stores (SSH keys, AWS profiles) within a tight time window. This rule specifically looks for file access events on common credential files (id_rsa, credentials, config) within sensitive directories (.ssh, .aws, .kube) that are initiated by a process whose command line contains keywords often associated with development activities or social engineering lures (interview, test, assignment).
This rule detects the targeted extraction of NPM authentication tokens by monitoring process command lines for the string 'npm_' and correlating it with network connections to a specific IP address (216.126.225.129). This behavior is associated with the Megalodon CI/CD malware.
Detects the execution of a malicious npm package (scope squatting on @withgoogle/stitch-sdk) that runs a preinstall script designed to harvest sensitive credentials (Claude, Git, SSH, GitHub, npm, Docker) and exfiltrate them to the domain 'stitch-production.org'.
This rule detects unauthorized or suspicious file access to sensitive configuration, credential, and identity files by 'node.exe' or 'bun.exe' processes. It flags instances where these runtime processes access multiple unique sensitive files, excluding those officially associated with the Node.js or OpenJS Foundations, which is a common indicator of credential exfiltration or reconnaissance by malicious scripts in an environment.
Detects a non-browser process creating copies of at least three Chromium credential or browsing databases in a temporary, roaming, public, or program-data directory. The logic requires the reported SessionGate, Remus, or AnimateClipper structure rather than a standalone executable name.
Detects unauthorized access to cloud provider credential files (AWS, GCP, Azure) by potentially suspicious processes. It specifically monitors processes such as node.exe, npm, python, bash, or binaries running from temporary directories (/tmp, %TEMP%) while excluding legitimate CLI tools.
Detects suspicious access to web browser credential files (Login Data, Cookies) by processes other than the browsers themselves. This could indicate an attempt to steal stored credentials.
Page 25 of 34