Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
707 detections
Filters
Last updated
All Time
Detection languages
362
144
48
42
25
Contributors
209
170
72
54
41
Categories
485
297
189
112
77
Platforms
413
316
165
62
53
Products / Services
162
112
62
36
34
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
707
CVEs
5
5
4
3
2
IDS Classtypes
15
5
4
2
IDS Protocols
24
2
1
Detects unauthorized access, creation, or modification of sensitive credential and token files (e.g., OAuth tokens, AWS credentials, gcloud tokens) in common user directories like AppData or .config by processes other than established browsers or legitimate cloud CLI tools. This behavior is indicative of credential theft or SaaS pivot attacks.
This rule detects attempts by non-browser processes to access sensitive web browser credential files such as 'Login Data', 'key4.db', and 'logins.json'. This activity is highly indicative of credential dumping or information theft, as legitimate browser processes are excluded from the detection.
Detects suspicious access attempts by non-native processes to sensitive application data such as Discord local state, Telegram tdata, Steam SSFN tokens, and Roblox session cookies. This activity could indicate an attempt to steal session tokens or credentials for unauthorized access.
This rule detects suspicious script execution on macOS devices that targets known cryptocurrency wallet applications or data files. It looks for command-line executions involving common shell interpreters (sh, bash, zsh, osascript) that contain strings associated with Ledger Live, Trezor Suite, Exodus, Electrum, or generic 'wallet.dat' files. This activity could indicate an attempt to steal cryptocurrency wallet information or funds.
Detects the use of the 'watch' command in conjunction with 'cat' to continuously poll the GitHub CLI config file (.config/gh/hosts.yml). This activity could indicate an attacker attempting to capture new GitHub tokens as soon as a developer logs in.
Detects attempts by non-browser processes to access sensitive Chromium-based browser data files such as Login Data, Cookies, History, Web Data, and Local State. This rule focuses on file creation events and excludes legitimate browser processes from the principal. The UDM rule retains principal and target context for correlation.
Detects PHP runtime processes anomalously accessing the .env file, bypassing normal application routing to directly scrape database credentials.
This rule detects potential credential harvesting activity associated with the Hannibal Stealer. It looks for non-standard processes (processes other than the browsers themselves) that access sensitive browser credential stores (like 'Login Data', 'cookies.sqlite', or 'key4.db') and correlate these file access events with the loading of 'bcrypt.dll' or 'CefSharp.BrowsersSubprocess.dll', which are often used for decryption or browser automation/sub-processes during credential theft.
This rule detects when non-FileZilla processes attempt to read or access sensitive FileZilla configuration files, specifically 'recentservers.xml' or 'sitemanager.xml', which are known to store plain-text credentials for site connections. This behavior is indicative of credential harvesting.
Detects access to .env files that may contain plaintext credentials
Detects suspicious process execution patterns associated with the Miasma worm, which attempts to scrape GitHub Actions Runner.Worker process memory to extract masked secrets. This rule looks for specific command-line arguments used by memory dumping tools or scripts targeting the GitHub Actions Runner.Worker process, including `grep` for secret JSON structures, `python` targeting `/proc/pid/mem`, and specific shell pipeline combinations observed in Miasma payloads.
Detects automated API calls listing secrets via GitHub Actions with high pagination, indicating a script enumerating organizational secrets.
Detects unauthorized reading of the GitHub CLI hosts.yml file by processes other than standard development tools (gh, gh.exe, code). This activity could indicate an attempt to steal authenticated GitHub sessions, as the hosts.yml file contains sensitive GitHub authentication tokens.
Detects the creation of temporary files containing harvested tokens in the /tmp/ directory. This activity is indicative of a script using these files as a staging ground before network exfiltration. The rule specifically looks for file creation events in '/tmp/' where the filename contains 'tokens' and the initiating process is a common shell or text processing utility.
Detects suspicious file read or access events targeting cryptocurrency wallet files (e.g., wallet.dat, keystore, .metamask, Exodus wallet) and browser extension data stores (e.g., Chrome Local Extension Settings, MetaMask, BraveSoftware). The rule specifically excludes common browser processes to reduce false positives, indicating an attempt by an unauthorized process to enumerate or scrape sensitive cryptocurrency-related data.
Detects a spike in successful operations related to Azure Storage Account Keys by a single caller within a one-hour window. This could indicate an adversary attempting to enumerate, access, or exfiltrate storage account keys, or a legitimate user performing multiple key management activities.
Detects access to AWS credentials files for cloud account credential theft
Maps the malicious cache wrapper accessing local Steam configuration files for token harvesting.
Identifies suspicious access to Steam configuration files (loginusers.vdf) by processes other than legitimate Steam applications, combined with network connections to known malicious URLs associated with token theft. This rule aims to detect injected or hidden wrappers attempting to steal Steam tokens.
Identifies network traffic requesting 'te_3_la.js', a script used by UnregStealer to strip password masking from DOM elements, facilitating credential theft.
This rule detects a malicious npm package attempting to read Claude MCP connection settings, which may contain sensitive information like API keys and server details. The theft of MCP configuration could allow attackers to impersonate AI integrations. If this rule triggers, the package should be removed, and any associated API keys should be rotated. Further investigation should involve questioning the user about recent software installations or clicked links, and engaging the security team if the situation remains unclear.
Page 26 of 34