Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
707 detections
Filters
Last updated
All Time
Detection languages
362
144
48
42
25
Contributors
209
170
72
54
41
Categories
485
297
189
112
77
Platforms
413
316
165
62
53
Products / Services
162
112
62
36
34
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
707
CVEs
5
5
4
3
2
IDS Classtypes
15
5
4
2
IDS Protocols
24
2
1
This query detects multiple TTPs associated with the Storm-2561 campaign that uses SEO poisoning to distribute fake VPN clients for credential theft. It looks for known file hashes, a specific code-signing certificate, malicious DLL side-loading and C2 communication patterns.
Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously.
While it is a legitimate tool, intended for use in CI pipelines and security assessments,
It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.
While it is a legitimate tool, intended for use in CI pipelines and security assessments,
It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.
Detects a FortiGate configuration file download followed by the creation of a new computer account in Active Directory by the 'fortidcagent' service account within a short time window. This pattern may indicate an attacker has compromised a FortiGate appliance, extracted credentials from the configuration, and is now using them to join a rogue device to the domain for lateral movement.
Detects a FortiGate configuration file download occurring within 10 minutes of a successful administrative login from the same user and source IP address. This rapid sequence of events can indicate an attacker who has gained administrative access and is proceeding to exfiltrate sensitive configuration data, which may contain credentials for other systems.
Detects non-browser processes accessing sensitive files within web browser profiles, such as credential stores (Login Data), cookies, or local storage databases (LevelDB). This behavior is indicative of credential theft and was observed in multiple modules of the StegaBin infostealer toolkit, which targeted browser-stored credentials and cryptocurrency wallet extensions.
Detects broad filesystem searches using native OS commands ('dir' on Windows, 'find' on Linux/macOS) for files containing sensitive developer information like private keys, mnemonic phrases, and configuration files. This TTP is used by modules 5 and 6 of the StegaBin toolkit.
Detects the creation of an unusual lock file at `/usr/share/nano/.lock`. This specific path is used by a backdoored Go module (impersonating golang.org/x/crypto) to temporarily store harvested plaintext passwords before exfiltration. The rule specifically looks for file creation events at this highly specific path.
This rule detects suspicious code search queries within Azure DevOps audit logs that may indicate an adversary is attempting to find sensitive information such as passwords, API keys, tokens, or private keys. It specifically looks for keywords like 'password', 'secret', 'token', 'apikey', 'api_key', 'connectionstring', 'connstring', 'credential', 'private key', and 'BEGIN RSA PRIVATE KEY' in code search queries.
Detects common shell tools accessing OpenClaw plaintext workspace secrets such as the .env file under ~/.openclaw/workspace/.
Detects a Node.js process accessing sensitive files such as environment configuration files (.env) or browser credential/session stores. This behavior was observed in a developer-targeting campaign where attackers exfiltrated secrets from compromised developer machines.
This rule detects the presence of hardcoded tokens associated with the dYdX supply chain attack. These tokens were used for C2 authentication and as an API key for data exfiltration. The rule searches across process command lines, network URLs, network headers, and common security logs for these specific tokens.
This rule detects the use of the malicious GitHub Action 'ci-quality/code-quality-check@v1' associated with the SANDWORM_MODE campaign. This action is designed to harvest CI secrets and propagate the malware by being referenced in a GitHub workflow file. The rule searches for the specific string of the malicious GitHub action within file content or file/audit paths, specifically targeting GitHub workflow files (.yml or .yaml) in '.github/workflows/' directories.
This rule detects the presence of environment variables used to control the malicious SANDWORM_MODE payload in CI environments or on local systems. The presence of these variables in a process command line is a strong indicator of an active infection or a workflow being manipulated by the malware's control logic.
Detects when a Visual Studio Code process (Code.exe) or its underlying Node.js process accesses sensitive user directories or files. This could indicate the exploitation of a vulnerable extension, such as in CVE-2025-65717, to steal credentials or other sensitive data.
Detects execution of suspicious tools or commands that may indicate credential or secret discovery. Generic detection for processes attempting to enumerate credentials, secrets, or sensitive information across files, repositories, or environments.
Detects a process reading a .env file, which often contains sensitive credentials like API keys. This is often the first step of a data exfiltration pattern where the credentials are then sent to an attacker-controlled server. This behavior was observed in the malicious 'rankaj' OpenClaw skill. This rule should be correlated with subsequent network activity from the same process to a rare destination.
Detects the use of lifecycle hooks in `.devcontainer/devcontainer.json` files to execute potentially malicious commands. Adversaries can abuse hooks like `postCreateCommand` or `postStartCommand` in development environments like GitHub Codespaces to automatically run scripts upon container creation. This can be used to exfiltrate secrets, such as GitHub tokens, or establish further access.
Detects the use of lifecycle hooks in `.devcontainer/devcontainer.json` files to execute potentially malicious commands. Adversaries can abuse hooks like `postCreateCommand` or `postStartCommand` in development environments like GitHub Codespaces to automatically run scripts upon container creation. This can be used to exfiltrate secrets, such as GitHub tokens, or establish further access.
Detects attempts to access the sensitive Clawdbot/Moltbot configuration file (clawdbot.json or moltbot.json). This file contains API keys and gateway tokens. Unauthorized access, often resulting from prompt injection attacks, can lead to full agent and system compromise.
This rule detects potential credential harvesting and cryptocurrency wallet theft activities, specifically targeting browser data, SSH keys, cloud credentials, and crypto wallets. It looks for command-line patterns indicative of accessing or copying these sensitive files. The rule also includes a condition for Node.js processes attempting to exfiltrate credential-related data. The detection logic combines multiple conditions, such as browser credential access with SSH key theft, or cloud credential access with crypto wallet access, and Node.js exfiltration attempts combined with any of the credential/wallet access patterns.
This rule detects when known code scanning tools like Trufflehog, Gitleaks, or Gittyleaks attempt to read the AWS credentials file. This activity could indicate an adversary or an internal security tool searching for sensitive AWS access keys and tokens.
Page 30 of 34