Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
339 detections
Filters
Last updated
All Time
Detection languages
120
95
28
25
18
Contributors
111
38
29
22
22
Categories
227
127
107
45
27
Platforms
254
58
57
11
10
Products / Services
76
70
29
21
17
MITRE Techniques
18,108
15,615
12,573
8,385
6,206
CVEs
2
2
1
1
1
IDS Classtypes
7
1
IDS Protocols
8
Detects instances where processes typically associated with browser-related tasks (smartscreen.exe, ctfmon.exe) load ntdll.dll while another process on the same device is running with browser-specific command-line arguments (e.g., --user-data-dir, --profile-directory). This pattern is often indicative of process injection or credential harvesting attempts where an adversary attempts to interact with or scrape data from active browser sessions.
This rule detects the presence of the malicious 'pdf-para-texto@extensao.local' Firefox extension on disk. This extension is known to perform browser-based credential interception by patching the WebAuthn PublicKeyCredential interface at document_start on Google-related domains to facilitate account takeover.
Detects AI coding assistants and LLM agent frameworks attempting to access, read, or export sensitive credential files, registry hives, or application secrets. The rule monitors both file system operations on known secret locations and process execution patterns indicative of credential dumping or API token retrieval by these tools.
Detects AI coding assistants and LLM agent frameworks attempting to access, read, or export sensitive credential files, registry hives, or application secrets. The rule monitors both file system operations on known secret locations and process execution patterns indicative of credential dumping or API token retrieval by these tools.
Detects Node.js or ProfileQuickHost processes performing file operations (read, write, rename) on sensitive browser directories, such as 'Local Extension Settings' or wallet-related folders. This pattern is commonly observed in credential-stealing malware attempting to extract browser-stored secrets or cryptocurrency wallet data.
Detects anomalous process activity that reads sensitive developer secrets (such as Anthropic, OpenAI, Gemini, or Hugging Face API keys) from common configuration or environment files, followed by an outbound network connection to a non-private IP address. This behavior is consistent with credential harvesting and exfiltration tactics used in supply chain attacks to hijack AI services.
This rule detects potential credential theft by correlating access to local git credential files (e.g., .git-credentials, .netrc) followed by a git push event from the same user account within 24 hours. The rule flags these pushes if they originate from an unrecognized host or an IP address outside of the trusted internal network range.
Detects potential Remus infostealer activity by monitoring unauthorized processes accessing AI agent credential directories (Claude, Cursor, OpenCode, Codex) or cryptocurrency wallet files, specifically when combined with .lnk shortcut file access behavior.
This rule detects unauthorized access, creation, or modification of Git credential files (.git-credentials, .netrc) by processes other than standard Git credential management utilities. It also monitors command-line activity that references these credential stores to identify potential attempts to exfiltrate or manipulate stored credentials.
Detects AI coding assistants and LLM agent frameworks attempting to access, read, or export sensitive credential files, registry hives, or application secrets. The rule monitors both file system operations on known secret locations and process execution patterns indicative of credential dumping or API token retrieval by these tools.
Detects file operations (open, read, write, rename) involving common sensitive credential files (e.g., .kdbx password databases, .ovpn and .pcf configuration files, .pem, and .ssh directory contents) by processes not authorized to interact with these files.
Detects HTTP POST requests targeting the '/api/credentials' path on non-standard port 8133, which is indicative of AMOS (Atomic macOS Stealer) malware exfiltrating stolen credentials to a remote command and control server.
Detects HTTP POST requests to '/api/credentials' over a non-standard port (8133) typical of AMOS (Atomic macOS Stealer) command and control traffic. The rule specifically looks for established network connections originating from the local network and targeting external hosts, flagging multiple occurrences within a 30-second window.
Detects HTTP POST requests to '/api/credentials' over a non-standard port (8133) typical of AMOS (Atomic macOS Stealer) command and control traffic. The rule specifically looks for established network connections originating from the local network and targeting external hosts, flagging multiple occurrences within a 30-second window.
Detects HTTP POST requests to '/api/credentials' which is indicative of the AMOS (Atomic macOS) Stealer malware exfiltrating stolen credentials. The rule uses a threshold to identify multiple exfiltration attempts from the same source within a short time window.
Detects HTTP POST requests to '/api/credentials' which is indicative of the AMOS (Atomic macOS) Stealer malware exfiltrating stolen credentials. The rule uses a threshold to identify multiple exfiltration attempts from the same source within a short time window.
This rule detects a suspicious sequence of AWS CloudTrail events where a single identity performs a burst of discovery and enumeration activities (reconnaissance) followed shortly by requests to access sensitive secrets, credentials, or sensitive files (e.g., .env files). This pattern is indicative of an attacker who has gained initial access and is pivoting to identify and exfiltrate credentials.
Detects unauthorized access, modification, or creation of the FileZilla 'sitemanager.xml' configuration file by a process other than the legitimate 'filezilla.exe'. This is a common indicator of an adversary attempting to steal stored FTP credentials or modify connection configurations.
Detects Node.js or ProfileQuickHost processes performing file operations (read, write, rename) on sensitive browser directories, such as 'Local Extension Settings' or wallet-related folders. This pattern is commonly observed in credential-stealing malware attempting to extract browser-stored secrets or cryptocurrency wallet data.
Detects anomalous process activity that reads sensitive developer secrets (such as Anthropic, OpenAI, Gemini, or Hugging Face API keys) from common configuration or environment files, followed by an outbound network connection to a non-private IP address. This behavior is consistent with credential harvesting and exfiltration tactics used in supply chain attacks to hijack AI services.
Detects anomalous process activity that reads sensitive developer secrets (such as Anthropic, OpenAI, Gemini, or Hugging Face API keys) from common configuration or environment files, followed by an outbound network connection to a non-private IP address. This behavior is consistent with credential harvesting and exfiltration tactics used in supply chain attacks to hijack AI services.
Page 3 of 17