Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
707 detections
Filters
Last updated
All Time
Detection languages
362
144
48
42
25
Contributors
209
170
72
54
41
Categories
485
297
189
112
77
Platforms
413
316
165
62
53
Products / Services
162
112
62
36
34
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
707
CVEs
5
5
4
3
2
IDS Classtypes
15
5
4
2
IDS Protocols
24
2
1
Detects file creation events associated with the Mini Shai-Hulud npm/PyPI supply-chain attack campaign targeting TanStack, Mistral AI, OpenSearch, and Guardrails AI packages.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects suspicious npm activity indicative of the PhantomRaven Wave 5 supply chain attack. This includes node.js processes executing scripts from temporary directories during npm install, node.js processes accessing credential files (.gitconfig, .npmrc, .aws/credentials, .ssh) during npm lifecycle events, and the installation of known malicious npm package names associated with PhantomRaven.
Detects attempts by non-Azure Arc agent processes to access '.key' files within the Azure Arc Tokens directory. This activity could indicate an attempt to exploit CVE-2026-26117 or other credential access techniques targeting Azure Arc service principal tokens.
Detects attempts by non-Azure Arc agent processes to access '.key' files within the Azure Arc Tokens directory. This activity could indicate an attempt to exploit CVE-2026-26117 or other credential access techniques targeting Azure Arc service principal tokens.
Detects suspicious command-line arguments indicative of potential credential access attempts (cmdkey /list), or execution of hidden processes (excluding Java applications), or communication with a known malicious domain (staybud.dpdns.org).
Detects command-line execution that attempts to access GitHub authentication tokens outside of expected CI/CD or development environments. This could indicate an attempt to steal or misuse credentials.
This rule detects processes attempting to access web browser credential files (e.g., 'Login Data', 'Web Data') within the AppData directory. This activity is often associated with credential dumping techniques used by adversaries to steal stored browser credentials.
Detects command-line activity associated with the execution of the Checkmarx compromise payload (mcpAddon.js), which systematically attempts to dump tokens from gh, gcloud, az, and azd CLI tools.
Detects the specific PowerShell command structures used by the TeamPCP Checkmarx payload (mcpAddon.js) to extract and process Azure access tokens using the Az.Accounts module.
Detects suspicious processes attempting to access Microsoft Teams local storage or cookies via command line parameters, a technique commonly used by info-stealers. The rule specifically looks for command line arguments targeting 'Cookies' or 'Local Storage\leveldb' paths within the Microsoft Teams directory, while excluding legitimate Teams executables to reduce false positives.
Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS.
When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.
When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.
Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.
Detects indicators of the TeamPCP LiteLLM supply chain compromise. This includes the creation or modification of specific malicious files (litellm_init.pth, tpcp.tar.gz, sysmon.py, sysmon.service), execution of commands related to persistence (systemctl for sysmon.service), data archiving (tar for tpcp.tar.gz), or direct execution of the backdoor (sysmon.py). It also identifies network connections or DNS queries to known command and control (C2) domains (models.litellm.cloud, checkmarx.zone) and HTTP requests to checkmarx.zone. Furthermore, the rule detects unauthorized AWS API calls (ListSecrets, GetSecretValue, DescribeParameters) made using the 'python-urllib' user agent, which is indicative of custom scripting rather than standard boto3 usage.
This rule detects attempts to exploit a vulnerability in ShareFile (CVE-2026-2699/CVE-2026-2701) by monitoring for HTTP GET requests to the `/ConfigService/api/StroageZoneConfig` URI path with a `h=` query parameter. This pattern is indicative of an attacker trying to leak API secrets.
Detects a Python-initiated process attempting to read Google Cloud Platform (GCP) credentials by looking for command-line arguments containing 'GOOGLE_APPLICATION_CREDENTIALS' and 'cat 2>/dev/null'. This behavior is indicative of credential harvesting, potentially related to supply chain compromises like the Trivy incident.
Detects attempts by non-Azure Arc agent processes to access '.key' files within the Azure Arc Tokens directory. This activity could indicate an attempt to exploit CVE-2026-26117 or other credential access techniques targeting Azure Arc service principal tokens.
Detects attempts by non-Azure Arc agent processes to access '.key' files within the Azure Arc Tokens directory. This activity could indicate an attempt to exploit CVE-2026-26117 or other credential access techniques targeting Azure Arc service principal tokens.
Detects command line executions from non-standard applications attempting to query the local Azure Arc metadata endpoints (ports 40341/40342), which may indicate an attacker enumerating or exploiting the HIMDS token service (CVE-2026-26117).
AWS EC2 GetPasswordData API Call
Cortex XDR
Detects when the AWS EC2 GetPasswordData API call is made. This API call retrieves the Windows administrator password for an EC2 instance, which could indicate an attempt to gain unauthorized access to an instance.
Azure Blob Storage Account Key Access
Cortex XDR
Detects successful access to Azure Blob Storage using storage account keys (key1 or key2). This activity is often indicative of an adversary using compromised credentials to access cloud storage resources.
Page 29 of 34