Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
707 detections
Filters
Last updated
All Time
Detection languages
362
144
48
42
25
Contributors
209
170
72
54
41
Categories
485
297
189
112
77
Platforms
413
316
165
62
53
Products / Services
162
112
62
36
34
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
707
CVEs
5
5
4
3
2
IDS Classtypes
15
5
4
2
IDS Protocols
24
2
1
Detects attempts to exfiltrate environment variables by piping the output of 'env' or 'printenv' commands into 'curl'. This technique can be used by adversaries, such as the Miasma malware, to quickly steal sensitive API keys or other credentials stored in environment variables.
Detects the gh-token-monitor script using grep to extract GitHub Classic or Fine-Grained tokens (matching the ghp_ or gho_ structure) from the filesystem. This rule specifically looks for process command lines containing 'grep' and the regex pattern 'gh[po]_[a-zA-Z0-9]{36}', which is indicative of searching for GitHub tokens.
Detects suspicious file read or access events targeting cryptocurrency wallet files (e.g., wallet.dat, keystore, .metamask, Exodus wallet) and browser extension data stores (e.g., Chrome Local Extension Settings, MetaMask, BraveSoftware). The rule specifically excludes common browser processes to reduce false positives, indicating an attempt by an unauthorized process to enumerate or scrape sensitive cryptocurrency-related data.
Detects suspicious reads of the .git-credentials file by non-git processes. This file often contains plaintext Git passwords or tokens, making it a target for credential theft.
Detects `grep` commands searching for the exact JSON structure (`"isSecret": true`) used by GitHub Actions to store masked secrets in memory. This activity could indicate an adversary attempting to discover sensitive information.
Detects attempts by non-browser processes to access sensitive Chromium-based browser data files such as Login Data, Cookies, History, Web Data, and Local State. This rule focuses on file creation events and excludes legitimate browser processes from the principal. The UDM rule retains principal and target context for correlation.
Tracks browser network events where chrome.exe or msedge.exe are fetching a dynamic extension script named 'whitelist.extension.txt'. This activity is associated with the UnregStealer malware, which is known for human-operated browser credential theft.
This rule detects attempts by a malicious cache wrapper (specifically, a process named `._cache_GAME1.exe`) to access local Steam configuration files, which could indicate token harvesting. The rule looks for file access events on paths containing `\config\loginusers.vdf` initiated by the specified malicious process.
Detects access to Chrome Login Data SQLite file for credential theft
Detects when the 'node.exe' process attempts to read sensitive developer key files such as '.git-credentials', '.npmrc', or 'config.json' directly from disk. This behavior is indicative of a malicious NPM script attempting to harvest local authentication tokens.
Detects access to Chrome Login Data SQLite file for credential theft
Detects access to .env files that may contain plaintext credentials
This rule detects when a process other than Firefox itself attempts to access critical Firefox profile artifacts such as key4.db, cert9.db, logins.json, cookies.sqlite, places.sqlite, formhistory.sqlite, and prefs.js. This activity is highly suspicious as these files contain sensitive user data including credentials, browsing history, and preferences, and are typically targeted by malware for data exfiltration or credential theft. The rule leverages causality fields for investigation into the actor and the causal process.
Detects the creation or modification of 'gh-token-monitor.sh', a script identified as part of the Miasma toolkit, used for harvesting developer credentials. This script's presence or alteration on a system indicates potential credential access attempts.
Detects unauthorized access to the .npmrc file by unusual processes. Miasma targets this file to hijack NPM publishing rights and propagate supply chain attacks. The rule specifically looks for file access events on '.npmrc' where the initiating process is not a known legitimate NPM-related tool like 'npm', 'node', 'bun', or 'yarn'.
Detects Python processes accessing sensitive credential paths, a common post-exploitation step for malicious ML models (e.g., CVE-2026-4372). The rule specifically looks for Python executables accessing paths commonly associated with cloud (AWS) or container (Kubernetes) credentials. It includes exclusions for known legitimate ML pipeline scripts to reduce noise.
Detects unauthorized access to KeePass password database files
Detects access to browser profile data outside of authorized browser processes
Detects unauthorized access to KeePass password database files
Detects access to browser profile data outside of authorized browser processes
This rule searches CI logs and commands for patterns that extract GitHub secret values where isSecret is true. Automated secret scraping in pipelines leads to repository takeover. Audit workflow YAML changes. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Page 27 of 34