Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
707 detections
Filters
Last updated
All Time
Detection languages
362
144
48
42
25
Contributors
209
170
72
54
41
Categories
485
297
189
112
77
Platforms
413
316
165
62
53
Products / Services
162
112
62
36
34
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
707
CVEs
5
5
4
3
2
IDS Classtypes
15
5
4
2
IDS Protocols
24
2
1
Detects unauthorized access, modification, or creation of the FileZilla 'sitemanager.xml' configuration file by a process other than the legitimate 'filezilla.exe'. This is a common indicator of an adversary attempting to steal stored FTP credentials or modify connection configurations.
Detects access to sensitive cryptocurrency wallet files (wallet.dat, seed phrases, keys) or the execution of Python processes from sensitive or commonly exploited directories (AppData, tmp, Public folders) associated with known malicious naming conventions (sys_service).
Detects anomalous activity where an AI coding assistant process reads sensitive local credential files (such as .env, .aws/credentials, or SSH keys) followed by an outbound network connection to a destination not associated with known package registries or AI provider APIs. This pattern is indicative of potential prompt-injection attacks targeting autonomous AI coding tools to exfiltrate developer secrets.
Detects anomalous process activity that reads sensitive developer secrets (such as Anthropic, OpenAI, Gemini, or Hugging Face API keys) from common configuration or environment files, followed by an outbound network connection to a non-private IP address. This behavior is consistent with credential harvesting and exfiltration tactics used in supply chain attacks to hijack AI services.
Detects anomalous process activity that reads sensitive developer secrets (such as Anthropic, OpenAI, Gemini, or Hugging Face API keys) from common configuration or environment files, followed by an outbound network connection to a non-private IP address. This behavior is consistent with credential harvesting and exfiltration tactics used in supply chain attacks to hijack AI services.
This rule detects the creation, modification, or renaming of files that contain sensitive keywords (e.g., 'password', 'seed', 'wallet', 'recovery') by processes other than standard system or productivity applications. This activity is indicative of credential or sensitive data harvesting.
Detects access, reading, or modification of sensitive credential files (such as KeePass databases, VPN profiles, private SSH keys, and certificates) by a process. This behavior is often associated with pre-encryption staging for data exfiltration during ransomware attacks.
Detects the execution of an ONVIF-related tool or process with flags indicating credential retrieval. This is often associated with the reconnaissance or credential access phase targeting IoT devices such as cameras that support the Open Network Video Interface Forum (ONVIF) protocol.
Detects the execution of the OnvifUser utility with the -u flag, a technique observed in post-exploitation scenarios on Dahua network video recorder (NVR) devices to dump cached credentials.
Detects automated searching (via grep, findstr, or select-string) for sensitive strings (e.g., API keys, private keys, wallet data) across multiple occurrences on a single host, or the creation of suspicious sensitive files (e.g., .env, credentials, wallet.dat) on devices where such automated sweeping activity has been observed. This pattern indicates an adversary staging data for exfiltration.
This rule detects potential unauthorized access to sensitive information by correlating the execution of command-line tools (sed, bash, sh) with secret-related flags or file references, followed shortly by execution of cloud CLI commands that enumerate or retrieve secrets. This behavior is indicative of an attacker attempting to parse or extract sensitive data stored in local configuration files or memory, and then fetching specific secret values from a cloud secret manager.
This rule detects file access events targeting sensitive files such as credential stores, configuration files (e.g., .env, config.yaml, wallet.dat), and AWS credential files. This is indicative of an adversary searching for stored secrets or configuration data to facilitate further lateral movement or privilege escalation. The rule excludes common developer tools like code editors and file explorers to reduce noise.
Detects the creation, modification, or renaming of files named '.passphrase' or '.txid' within user directories. These file names are indicative of potential sensitive credential or wallet-related data storage, which may be targeted by adversaries for credential theft or unauthorized access.
Detects unauthorized access or file creation events targeting the 'tdata' directory, which stores local Telegram session and authentication data. The rule triggers when processes other than legitimate Telegram or system file explorers interact with these files, a common technique for session theft and account takeover.
Detects file creation, modification, or renaming activity within AppData directories associated with VPN clients (CyberGhost, NordVPN, ExpressVPN). This rule is intended to identify potential unauthorized access, staging, or tampering with VPN configuration files or credentials often stored in these application directories.
This rule detects behaviors associated with the Hannibal Stealer, specifically the identification of the Bitcoin Core wallet directory via registry lookups (strDataDir) followed by the unauthorized copying of 'wallet.dat' files into a staging directory structure, commonly used for cryptocurrency wallet exfiltration.
Detects suspicious processes accessing cryptocurrency wallet data files or web browser extension storage folders associated with popular crypto wallets. This behavior is indicative of credential theft or wallet data exfiltration by malware targeting digital assets.
Detects a multi-stage, automated attack chain performed by AI-based development agents (e.g., Claude, Copilot, Cursor). The rule correlates process discovery, credential access, file collection (staging), and exfiltration over web services within a tight 15-minute window, identifying potential autonomous exploitation and data exfiltration. Covered T1046, T1552.001, T1078, T1005, T1567
Detects access to sensitive files (KeePass databases, SSH private keys, and VPN configurations) by processes other than their designated applications. This behavior indicates potential credential harvesting or configuration exfiltration by unauthorized processes.
Detects anomalous cloud authentication events occurring within a 3-hour window after suspected unauthorized access to sensitive configuration or credential files on a Vite development server. The rule flags sign-ins with high risk, anomalous location, or missing device compliance information, excluding trusted corporate locations and devices, serving as an indicator of potential post-exfiltration account takeover.
This rule detects potentially malicious activity targeting Microsoft Entra Connect (formerly Azure AD Connect) servers. It identifies the execution of known credential harvesting tools like AADInternals or attempts to access/extract the ADSync database files and encryption components. Such actions indicate an attempt to gain unauthorized access to synchronized identities, local domain credentials, or cloud synchronization service accounts.
Page 6 of 34