Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
708 detections
Filters
Last updated
All Time
Detection languages
363
144
48
42
25
Contributors
209
170
72
54
41
Categories
486
297
190
113
77
Platforms
414
317
165
62
54
Products / Services
162
112
62
36
34
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
708
CVEs
5
5
4
3
2
IDS Classtypes
15
5
4
2
IDS Protocols
24
2
1
Detects anomalous cloud authentication events occurring within a 3-hour window after suspected unauthorized access to sensitive configuration or credential files on a Vite development server. The rule flags sign-ins with high risk, anomalous location, or missing device compliance information, excluding trusted corporate locations and devices, serving as an indicator of potential post-exfiltration account takeover.
Detects anomalous cloud authentication events occurring within a 3-hour window after suspected unauthorized access to sensitive configuration or credential files on a Vite development server. The rule flags sign-ins with high risk, anomalous location, or missing device compliance information, excluding trusted corporate locations and devices, serving as an indicator of potential post-exfiltration account takeover.
Detects anomalous cloud authentication events occurring within a 3-hour window after suspected unauthorized access to sensitive configuration or credential files on a Vite development server. The rule flags sign-ins with high risk, anomalous location, or missing device compliance information, excluding trusted corporate locations and devices, serving as an indicator of potential post-exfiltration account takeover.
Detects attempts to access sensitive files like environment variables (.env), cloud provider credentials (AWS/Azure), or Terraform state files via a web server interface, specifically targeting Vite development server deployments.
Detects successful authentication attempts to a LiteLLM proxy instance using the hardcoded default master key 'sk-1234'. This activity indicates potential exploitation of misconfigured instances where default credentials remain unchanged.
Detects anomalous access to WSO2 API Manager Store and Publisher endpoints involving the retrieval of sensitive information like consumer keys and secrets. The rule specifically targets requests authenticated with JWTs that exhibit headers indicative of 'alg=none' or other unsupported/forged algorithm patterns, often associated with CVE-2026-5430 exploitation attempts. The rule uses statistical baseline monitoring to identify volume spikes in requests to these sensitive paths.
Detects processes other than the official Telegram desktop client accessing sensitive local data files ('key_datas', 'settingss', 'usertag') within the Telegram application directory. This activity is often associated with credential theft or session hijacking.
This rule monitors for high-volume, suspicious activity involving the enumeration of sensitive cloud resources across multiple Azure services (e.g., Kubernetes cluster secrets, KeyVault secrets, Backup vault items, and DataFactory/Web connections). An alert is triggered when a single identity performs a high number of operations across multiple distinct resource types within a one-hour window, which is indicative of credential harvesting or cloud reconnaissance.
Detects successful authentication attempts to a LiteLLM proxy instance using the hardcoded default master key 'sk-1234'. This activity indicates potential exploitation of misconfigured instances where default credentials remain unchanged.
Detects credential harvesting behavior originating from known malicious RubyGems packages (pwnp999, exfiltestwand3, hacksvn1778554764) observed in RubyDoc.info build environments. The rule monitors process execution and file access activity involving these packages where the command line or file path includes patterns associated with credential theft (e.g., 'api_key', 'Authorization'), scoped to Ruby-related tooling such as 'ruby', 'gem', or 'bundle'.
Detects credential harvesting behavior originating from known malicious RubyGems packages (pwnp999, exfiltestwand3, hacksvn1778554764) observed in RubyDoc.info build environments. The rule monitors process execution and file access activity involving these packages where the command line or file path includes patterns associated with credential theft (e.g., 'api_key', 'Authorization'), scoped to Ruby-related tooling such as 'ruby', 'gem', or 'bundle'.
Detects a suspicious sequence of events within JFrog Artifactory where an account accesses sensitive code-signing material (rubygems/gemspec/signing keys) and subsequently performs administrative actions (user addition/role assignment/privilege escalation) within a one-hour window, indicating potential account takeover or exploitation.
Detects a suspicious sequence of events within JFrog Artifactory where an account accesses sensitive code-signing material (rubygems/gemspec/signing keys) and subsequently performs administrative actions (user addition/role assignment/privilege escalation) within a one-hour window, indicating potential account takeover or exploitation.
Detects access to sensitive credential stores (KeePass databases, Firefox logins, SSH keys, VPN configuration files) by suspicious processes, specifically those associated with potential credential harvesting tools or unauthorized update binaries.
This rule detects processes accessing sensitive credential, configuration, or environment files typically stored in locations like .aws, .ssh, .kube, or application user directories. It alerts when a non-standard or unexpected process touches multiple sensitive folders, or when specific suspicious process names or known malicious tools (such as 'NeedleStealer') are observed interacting with these files. This is indicative of potential credential harvesting or reconnaissance activities.
This rule detects processes accessing sensitive credential, configuration, or environment files typically stored in locations like .aws, .ssh, .kube, or application user directories. It alerts when a non-standard or unexpected process touches multiple sensitive folders, or when specific suspicious process names or known malicious tools (such as 'NeedleStealer') are observed interacting with these files. This is indicative of potential credential harvesting or reconnaissance activities.
This rule detects processes accessing sensitive credential, configuration, or environment files typically stored in locations like .aws, .ssh, .kube, or application user directories. It alerts when a non-standard or unexpected process touches multiple sensitive folders, or when specific suspicious process names or known malicious tools (such as 'NeedleStealer') are observed interacting with these files. This is indicative of potential credential harvesting or reconnaissance activities.
This rule detects processes accessing sensitive credential, configuration, or environment files typically stored in locations like .aws, .ssh, .kube, or application user directories. It alerts when a non-standard or unexpected process touches multiple sensitive folders, or when specific suspicious process names or known malicious tools (such as 'NeedleStealer') are observed interacting with these files. This is indicative of potential credential harvesting or reconnaissance activities.
Detects automated searching (via grep, findstr, or select-string) for sensitive strings (e.g., API keys, private keys, wallet data) across multiple occurrences on a single host, or the creation of suspicious sensitive files (e.g., .env, credentials, wallet.dat) on devices where such automated sweeping activity has been observed. This pattern indicates an adversary staging data for exfiltration.
Detects unauthorized access and data retrieval attempts from a MinIO object storage instance using default administration credentials (minioadmin:minioadmin). The rule monitors both command-line execution of MinIO client (mc) operations and network connections to MinIO service ports (9000/9001) that involve the use of the default credential pair.
Detects unauthorized access and data retrieval attempts from a MinIO object storage instance using default administration credentials (minioadmin:minioadmin). The rule monitors both command-line execution of MinIO client (mc) operations and network connections to MinIO service ports (9000/9001) that involve the use of the default credential pair.
Page 9 of 34