Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
55 detections
Filters
Last updated
All Time
Detection languages
20
13
8
4
4
Contributors
11
10
8
6
5
Categories
34
25
21
9
7
Platforms
55
6
5
2
Products / Services
18
15
10
4
3
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
2
2
IDS Protocols
4
Detects AI coding assistants and LLM agent frameworks attempting to access, read, or export sensitive credential files, registry hives, or application secrets. The rule monitors both file system operations on known secret locations and process execution patterns indicative of credential dumping or API token retrieval by these tools.
Detects AI coding assistants and LLM agent frameworks attempting to access, read, or export sensitive credential files, registry hives, or application secrets. The rule monitors both file system operations on known secret locations and process execution patterns indicative of credential dumping or API token retrieval by these tools.
Detects AI coding assistants and LLM agent frameworks attempting to access, read, or export sensitive credential files, registry hives, or application secrets. The rule monitors both file system operations on known secret locations and process execution patterns indicative of credential dumping or API token retrieval by these tools.
Detects AI coding assistants and LLM agent frameworks attempting to access, read, or export sensitive credential files, registry hives, or application secrets. The rule monitors both file system operations on known secret locations and process execution patterns indicative of credential dumping or API token retrieval by these tools.
Remote Registry Access via Winreg RPC
Cortex XDR
Detects suspicious remote registry operations performed through the Winreg RPC interface. The rule monitors for interactions with sensitive registry hives (e.g., SAM, SECURITY, SYSTEM) or anomalous levels of remote registry activity originating from remote connections (SMB, TCP, Named Pipes). Such activity is often associated with credential dumping tools like Impacket's secretsdump or unauthorized remote configuration discovery.
Detects AI coding assistants and LLM agent frameworks attempting to access, read, or export sensitive credential files, registry hives, or application secrets. The rule monitors both file system operations on known secret locations and process execution patterns indicative of credential dumping or API token retrieval by these tools.
Detects Bird Agent malware samples that exhibit characteristic behavior of binding configuration decryption to the Windows MachineGuid registry value. The rule identifies binaries that contain references to 'config.toml' and the Windows Cryptography registry key used to retrieve the MachineGuid, often used as a unique machine-based key for decryption.
The following analytic detects unauthorized access to Outlook credentials stored in the Windows registry.
It leverages Windows Security Event logs, specifically EventCode 4663, to identify access attempts to registry paths associated with Outlook profiles.
This activity is significant as it may indicate attempts to steal sensitive email credentials, which could lead to unauthorized access to email accounts.
If confirmed malicious, this could allow attackers to exfiltrate sensitive information, impersonate users, or execute further unauthorized actions within Outlook, posing a significant security risk.
It leverages Windows Security Event logs, specifically EventCode 4663, to identify access attempts to registry paths associated with Outlook profiles.
This activity is significant as it may indicate attempts to steal sensitive email credentials, which could lead to unauthorized access to email accounts.
If confirmed malicious, this could allow attackers to exfiltrate sensitive information, impersonate users, or execute further unauthorized actions within Outlook, posing a significant security risk.
Detects processes that systematically query registry keys associated with Outlook configuration and VNC remote access software (RealVNC, TightVNC, TigerVNC). Querying multiple distinct families of these sensitive keys in a short period is characteristic of automated reconnaissance by tools, such as the Remus malware framework, attempting to identify installed software and potential configuration details.
Detects remote registry operations performed through the Winreg RPC interface. This behavior is commonly associated with adversary tools like secretsdump used to extract sensitive Windows registry hives such as SAM, SECURITY, and SYSTEM. Monitoring remote registry access is crucial for identifying unauthorized data collection and credential access attempts.
Detects the presence of Toy Ghouls' mqtt-bird-agent or matrix-bird-agent backdoor binaries. These binaries are identified by specific filenames, the inclusion of ChaCha20-Poly1305 cryptographic indicators, and operations involving the Windows MachineGuid registry key used to seal configuration files.
Detects read access to the Windows Registry keys associated with Outlook profile SMTP passwords. Attackers may attempt to extract these credentials to gain unauthorized access to email accounts.
Detects high-frequency registry access (more than 50 events in a 1-minute window) by processes executing from common temporary, user-profile, or writable directories (e.g., AppData, Temp). This behavior is often associated with malware activity, such as credential dumping, persistence installation, or configuration modification.
Detects network traffic attempting to access sensitive Windows Registry keys (SAM, SECURITY, LSA Secrets, winlogon DefaultPassword) over the SMB protocol, which is indicative of credential harvesting activities.
This rule detects processes accessing registry keys associated with common cryptocurrency wallets (e.g., Electrum, Exodus, MetaMask, Ledger) that are not the legitimate wallet applications themselves. This behavior is indicative of unauthorized attempts to extract sensitive wallet information, such as configuration, seeds, or keys, stored in the Windows Registry.
This rule detects unauthorized or suspicious queries against Windows Registry paths known to contain sensitive information, including security hives (SAM, SECURITY), application-specific secrets (PuTTY, OpenSSH, RealVNC), and system autologon credentials. It monitors both command-line executions of 'reg.exe' and PowerShell commands targeting these registry keys.
Detects network traffic attempting to access sensitive Windows Registry keys (SAM, SECURITY, LSA Secrets, winlogon DefaultPassword) over the SMB protocol, which is indicative of credential harvesting activities.
This rule detects unauthorized or suspicious queries against Windows Registry paths known to contain sensitive information, including security hives (SAM, SECURITY), application-specific secrets (PuTTY, OpenSSH, RealVNC), and system autologon credentials. It monitors both command-line executions of 'reg.exe' and PowerShell commands targeting these registry keys.
This rule detects processes accessing registry keys associated with common cryptocurrency wallets (e.g., Electrum, Exodus, MetaMask, Ledger) that are not the legitimate wallet applications themselves. This behavior is indicative of unauthorized attempts to extract sensitive wallet information, such as configuration, seeds, or keys, stored in the Windows Registry.
This rule detects processes accessing registry keys associated with common cryptocurrency wallets (e.g., Electrum, Exodus, MetaMask, Ledger) that are not the legitimate wallet applications themselves. This behavior is indicative of unauthorized attempts to extract sensitive wallet information, such as configuration, seeds, or keys, stored in the Windows Registry.
This rule detects a single process attempting to access credential-related files (e.g., browser login data, FTP client configurations) and/or registry keys (e.g., PuTTY, WinSCP sessions) from at least two different application types within a 60-second window. This behavior is indicative of an attacker attempting to rapidly harvest credentials from various sources on a compromised endpoint.
Page 1 of 3