Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
339 detections
Filters
Last updated
All Time
Detection languages
120
95
28
25
18
Contributors
111
38
29
22
22
Categories
227
127
107
45
27
Platforms
254
58
57
11
10
Products / Services
76
70
29
21
17
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
CVEs
2
2
1
1
1
IDS Classtypes
7
1
IDS Protocols
8
Detects HTTP beaconing activity associated with the MacSync stealer malware on macOS platforms. The rule monitors for specific URI patterns ('curl', 'dynamic', 'gate') combined with macOS-specific User-Agent strings and potential credential exfiltration headers, indicating established communication with a Command and Control (C2) server.
Detects the CARBONATO GH0ST Hermes Agent activity of harvesting and storing AI API keys (such as OpenAI, Anthropic, Google Gemini, etc.) as plaintext files within the /root/.hermes/loot/ directory. This is consistent with the agent's behavior of staging credentials for later exfiltration.
This rule correlates endpoint-based alerts related to credential theft or infostealer malware with subsequent successful cloud identity authentication events. It identifies situations where a user, who has recently triggered a credential theft alert on an endpoint, logs into a cloud environment from a country or IP address that has not been historically associated with that user within a 24-hour window.
Detects unauthorized attempts to access sensitive Veeam Backup and Replication credentials by querying the backend SQL database or directly accessing DPAPI Master Key files. This activity is indicative of an attacker attempting to decrypt backup credentials stored by the Veeam service.
Detects suspicious post-compromise activity associated with ALPHV/BlackCat affiliates. This rule monitors for anomalous Kerberos ticket requests (e.g., weak encryption types or TGS requests) closely followed by access to sensitive credential stores or tools on the same host, which is indicative of credential harvesting after a session hijacking or initial access event.
Detects unauthorized, unsigned processes accessing sensitive browser files (Cookies, Login Data, Local State) across common browsers (Chrome, Edge, Brave, Firefox) followed by an outbound network connection. This behavior is indicative of credential-harvesting infostealer malware.
Detects the deployment and operational artifacts associated with the Hermes Agent framework using the CARBONATO GH0ST persona on Linux systems. This detection focuses on identifying specific file-system indicators, including persona configuration files (SOUL.md), loot staging directories, and deployment entry scripts (entry.sh or CARBONATO_API_KEY artifacts) that indicate malicious activity and potential AI-driven Telegram command and control (C2) staging.
Detects instances where the Claude Desktop application spawns a terminal or shell process that immediately executes commands associated with downloading remote payloads or accessing sensitive cryptocurrency wallet artifacts. This behavior is indicative of potential AI prompt injection where an AI assistant is coerced into executing malicious commands without user authorization.
This rule detects HTTP POST requests from mobile user agents (Android, Dalvik, okhttp) that contain keywords indicative of contactless payment card data exfiltration, specifically looking for fields such as 'track2', 'pan', 'atc', and 'cryptogram'. This behavior is consistent with malicious mobile applications attempting to transmit skimmed NFC credit card data to an external server.
Detects AI coding assistants and LLM agent frameworks attempting to access, read, or export sensitive credential files, registry hives, or application secrets. The rule monitors both file system operations on known secret locations and process execution patterns indicative of credential dumping or API token retrieval by these tools.
Detects a potential post-compromise lateral movement sequence where a host, previously identified as accessing sensitive browser credential files by an unauthorized process, subsequently initiates RDP or WinRM connections to other internal hosts using an account not previously observed performing interactive logons on that source host.
Detects processes that access multiple categories of sensitive data (browser autofill, cryptocurrency wallets, password manager exports, or system fingerprinting files) within a short time window. This behavior is highly indicative of modular infostealers or data-collection malware conducting 'stacking access' to stage sensitive information for exfiltration.
This rule detects unauthorized access, creation, or modification of Git credential files (.git-credentials, .netrc) by processes other than standard Git credential management utilities. It also monitors command-line activity that references these credential stores to identify potential attempts to exfiltrate or manipulate stored credentials.
Detects Node.js or Python processes exhibiting behavior characteristic of information-stealing malware (such as the WaterPlum suite: BeaverTail, InvisibleFerret, OtterCookie, StoatWaffle). The rule monitors for these processes accessing sensitive files related to browser credentials, cryptocurrency wallets, scanned identification documents, or performing collection activities like keylogging and screen capturing.
Detects bulk file access or modifications involving sensitive files such as certificates (.pfx, .p12, .pem, .key), password manager vaults (.kdbx, .kdb), and files containing keywords related to credentials or logins. This behavior is indicative of an adversary staging or exfiltrating sensitive security material for further credential access.
Detects anomalous file staging activity combined with keyword-matched file access or suspicious Steam application launches, characteristic of the Rapuncel (BoryptGrab) malware's credential and crypto-wallet harvesting routine.
Detects AI coding assistants and LLM agent frameworks attempting to access, read, or export sensitive credential files, registry hives, or application secrets. The rule monitors both file system operations on known secret locations and process execution patterns indicative of credential dumping or API token retrieval by these tools.
Detects outbound HTTP POST requests directed at the '/api/credentials' URI, a pattern associated with AMOS Stealer credential exfiltration. The rule includes a threshold to reduce noise by alerting only when multiple requests occur from a single source within a short timeframe.
Detects Node.js or Python processes exhibiting behavior characteristic of information-stealing malware (such as the WaterPlum suite: BeaverTail, InvisibleFerret, OtterCookie, StoatWaffle). The rule monitors for these processes accessing sensitive files related to browser credentials, cryptocurrency wallets, scanned identification documents, or performing collection activities like keylogging and screen capturing.
Detects instances where processes typically associated with browser-related tasks (smartscreen.exe, ctfmon.exe) load ntdll.dll while another process on the same device is running with browser-specific command-line arguments (e.g., --user-data-dir, --profile-directory). This pattern is often indicative of process injection or credential harvesting attempts where an adversary attempts to interact with or scrape data from active browser sessions.
Detects instances where processes typically associated with browser-related tasks (smartscreen.exe, ctfmon.exe) load ntdll.dll while another process on the same device is running with browser-specific command-line arguments (e.g., --user-data-dir, --profile-directory). This pattern is often indicative of process injection or credential harvesting attempts where an adversary attempts to interact with or scrape data from active browser sessions.
Page 2 of 17