Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
707 detections
Filters
Last updated
All Time
Detection languages
362
144
48
42
25
Contributors
209
170
72
54
41
Categories
485
297
189
112
77
Platforms
413
316
165
62
53
Products / Services
162
112
62
36
34
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
707
CVEs
5
5
4
3
2
IDS Classtypes
15
5
4
2
IDS Protocols
24
2
1
Detects attempts to bypass authentication on Nacos servers, including the use of spoofed Nacos-Server User-Agent headers, suspicious API query patterns missing required access tokens, and the subsequent use of forged JWT tokens signed with default keys.
Detects execution of AI coding assistants or CLI tools (such as Claude, Gemini, Copilot, etc.) that are attempting to access sensitive local configuration, credential, or authentication files, including SSH keys, AWS credentials, and browser cookies.
Detects when AI-powered coding assistant plugins or CLI tools (e.g., Claude, Copilot, Gemini) execute subprocesses that attempt to access sensitive configuration files, SSH keys, or cloud credential stores. This may indicate an AI tool being manipulated or misconfigured to exfiltrate sensitive local secrets.
Detects instances where processes other than the legitimate Telegram Desktop application or its updater attempt to access files within the Telegram Desktop 'tdata' directory. This directory contains session information, which can be harvested by malicious actors to hijack user sessions or access sensitive information.
Detects instances where processes other than the legitimate Telegram Desktop application or its updater attempt to access files within the Telegram Desktop 'tdata' directory. This directory contains session information, which can be harvested by malicious actors to hijack user sessions or access sensitive information.
This rule detects unauthorized processes modifying the 'Secure Preferences' configuration file in Google Chrome or Microsoft Edge browser data directories. This activity often indicates an attempt by malicious software to hijack browser settings, such as forcing extensions or modifying security policies, which is a common precursor to credential theft or persistent malicious access.
This rule detects unauthorized processes modifying the 'Secure Preferences' configuration file in Google Chrome or Microsoft Edge browser data directories. This activity often indicates an attempt by malicious software to hijack browser settings, such as forcing extensions or modifying security policies, which is a common precursor to credential theft or persistent malicious access.
Detects automated searching (via grep, findstr, or select-string) for sensitive strings (e.g., API keys, private keys, wallet data) across multiple occurrences on a single host, or the creation of suspicious sensitive files (e.g., .env, credentials, wallet.dat) on devices where such automated sweeping activity has been observed. This pattern indicates an adversary staging data for exfiltration.
Detects automated searching (via grep, findstr, or select-string) for sensitive strings (e.g., API keys, private keys, wallet data) across multiple occurrences on a single host, or the creation of suspicious sensitive files (e.g., .env, credentials, wallet.dat) on devices where such automated sweeping activity has been observed. This pattern indicates an adversary staging data for exfiltration.
Detects unauthorized access and data retrieval attempts from a MinIO object storage instance using default administration credentials (minioadmin:minioadmin). The rule monitors both command-line execution of MinIO client (mc) operations and network connections to MinIO service ports (9000/9001) that involve the use of the default credential pair.
Detects unauthorized access and data retrieval attempts from a MinIO object storage instance using default administration credentials (minioadmin:minioadmin). The rule monitors both command-line execution of MinIO client (mc) operations and network connections to MinIO service ports (9000/9001) that involve the use of the default credential pair.
Detects unauthorized access attempts to browser credential files (such as Login Data, key4.db, and cookies) by non-browser processes. This behavior is indicative of the Rapuncel infostealer, which harvests stored browser credentials after attempting to disable or bypass security solutions.
Detects unauthorized access attempts to browser credential files (such as Login Data, key4.db, and cookies) by non-browser processes. This behavior is indicative of the Rapuncel infostealer, which harvests stored browser credentials after attempting to disable or bypass security solutions.
This rule detects processes accessing or files being interacted with that are known to contain sensitive information, including API keys, credential files, database configurations, and cryptocurrency wallets. It monitors command-line activity for utilities like python, bash, and grep interacting with sensitive strings, and tracks file system access to sensitive paths.
Detects anomalous access to WSO2 API Manager Store and Publisher endpoints involving the retrieval of sensitive information like consumer keys and secrets. The rule specifically targets requests authenticated with JWTs that exhibit headers indicative of 'alg=none' or other unsupported/forged algorithm patterns, often associated with CVE-2026-5430 exploitation attempts. The rule uses statistical baseline monitoring to identify volume spikes in requests to these sensitive paths.
Detects anomalous access to WSO2 API Manager Store and Publisher endpoints involving the retrieval of sensitive information like consumer keys and secrets. The rule specifically targets requests authenticated with JWTs that exhibit headers indicative of 'alg=none' or other unsupported/forged algorithm patterns, often associated with CVE-2026-5430 exploitation attempts. The rule uses statistical baseline monitoring to identify volume spikes in requests to these sensitive paths.
Detects anomalous access to WSO2 API Manager Store and Publisher endpoints involving the retrieval of sensitive information like consumer keys and secrets. The rule specifically targets requests authenticated with JWTs that exhibit headers indicative of 'alg=none' or other unsupported/forged algorithm patterns, often associated with CVE-2026-5430 exploitation attempts. The rule uses statistical baseline monitoring to identify volume spikes in requests to these sensitive paths.
Detects unauthorized access to Discord's Local Storage leveldb files, a technique commonly used by malware like LxBaseRAT to extract Discord authentication tokens.
Detects the presence of Atomic macOS Stealer (AMOS) binaries and their associated malicious behaviors. The rule identifies suspicious artifacts including password prompt requests using osascript to deceive users, attempts to access keychain and browser credential databases, and the use of curl piping to remote shell execution which is a common delivery vector for this malware family.
Detects access to sensitive credential stores (KeePass databases, Firefox logins, SSH keys, VPN configuration files) by suspicious processes, specifically those associated with potential credential harvesting tools or unauthorized update binaries.
Detects repository activity involving the 'FETCH_HEAD' reference, which often indicates automated fetching, local caching, or potential attempts to manipulate or inspect the state of a Git repository during reconnaissance or post-exploitation activities.
Page 7 of 34