Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
339 detections
Filters
Last updated
All Time
Detection languages
120
95
28
25
18
Contributors
111
38
29
22
22
Categories
227
127
107
45
27
Platforms
254
58
57
11
10
Products / Services
76
70
29
21
17
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
2
2
1
1
1
IDS Classtypes
7
1
IDS Protocols
8
Detects the creation of specific staging files and directories associated with the Rapuncel infostealer (e.g., UserInformation.txt, installed_applications.txt, sends.log, browser_decryption.log, or the Filegraber directory) within Windows temporary storage paths. This activity typically occurs following the unauthorized collection of sensitive data such as credentials, digital wallet information, and messenger session data.
Detects modifications, creation, or renaming of common cryptocurrency wallet files (e.g., wallet.dat, .wallet files) within known storage directories. This behavior is often associated with infostealers or malware attempting to exfiltrate or manipulate user financial assets.
Detects potential Remus infostealer activity by monitoring unauthorized processes accessing AI agent credential directories (Claude, Cursor, OpenCode, Codex) or cryptocurrency wallet files, specifically when combined with .lnk shortcut file access behavior.
Detects potential Remus infostealer activity by monitoring unauthorized processes accessing AI agent credential directories (Claude, Cursor, OpenCode, Codex) or cryptocurrency wallet files, specifically when combined with .lnk shortcut file access behavior.
This rule detects successful authentication to Azure/M365 identity and security management portals (My Sign-Ins, My Apps, My Profile) shortly after a risky or suspicious sign-in event for the same user. This pattern often indicates an account takeover scenario where an adversary, having potentially compromised credentials, immediately accesses account settings to perform further malicious actions, such as registering MFA devices or updating security proofs.
Detects when AI-powered coding assistant plugins or CLI tools (e.g., Claude, Copilot, Gemini) execute subprocesses that attempt to access sensitive configuration files, SSH keys, or cloud credential stores. This may indicate an AI tool being manipulated or misconfigured to exfiltrate sensitive local secrets.
Detects unauthorized processes attempting to access sensitive application data files such as browser cookies, local state, or data stored by applications like Discord, Telegram, and Steam, which are frequent targets for credential-stealing malware.
Detects outbound network connections initiated by charmap.exe, a standard Windows utility that does not naturally communicate over the network. This activity is highly indicative of process injection or malicious code masquerading as a system utility to facilitate credential theft or command and control communication.
This rule detects potentially malicious file access patterns by the executable 'comet.exe'. It alerts when this process accesses sensitive files or directories associated with credentials, configuration files, or sensitive browser data, while explicitly excluding benign locations such as Chrome data folders and temporary directories.
Detects the 'Comet.exe' process, associated with the Perplexity Comet AI agent, accessing sensitive system files or configuration directories outside its expected scope. This pattern of file interaction is characteristic of unauthorized data collection or exfiltration attempts, specifically linked to the BragJack threat activity.
Detects the use of command-line tools like find and grep to recursively search the filesystem for files containing sensitive information, such as configuration files, environment variables, database credentials, and digital wallet keys. This behavior is indicative of an attacker performing automated discovery of credentials and secrets.
Detects NeedleStealer Rust-based stealer binaries via Go module path strings, C2 domain, build tag, and embedded browser wallet extension identifiers
Detects the 'Comet.exe' process, associated with the Perplexity Comet AI agent, accessing sensitive system files or configuration directories outside its expected scope. This pattern of file interaction is characteristic of unauthorized data collection or exfiltration attempts, specifically linked to the BragJack threat activity.
Detects unauthorized processes accessing cryptocurrency wallet data files, including 'wallet.dat' or specific browser-based extension storage databases (e.g., MetaMask, Coinbase Wallet), which is indicative of the Rapuncel stealer attempting to exfiltrate sensitive wallet data.
Detects unauthorized processes attempting to access sensitive browser files, specifically 'Login Data' (credentials) and 'Network/Cookies' databases for Google Chrome and Microsoft Edge. Legitimate browser processes and update services are explicitly excluded.
Detects GitLab's personal_access_tokens/self endpoint being queried via GET, the reconnaissance step a leaked token uses to confirm its own scopes and privilege level.
Detects NeedleStealer Rust-based stealer binaries via Go module path strings, C2 domain, build tag, and embedded browser wallet extension identifiers
Detects NeedleStealer Rust-based stealer binaries via Go module path strings, C2 domain, build tag, and embedded browser wallet extension identifiers
Detects NeedleStealer Rust-based stealer binaries via Go module path strings, C2 domain, build tag, and embedded browser wallet extension identifiers
Detects unauthorized processes attempting to access sensitive application data files such as browser cookies, local state, or data stored by applications like Discord, Telegram, and Steam, which are frequent targets for credential-stealing malware.
Detects unauthorized processes attempting to access sensitive application data files such as browser cookies, local state, or data stored by applications like Discord, Telegram, and Steam, which are frequent targets for credential-stealing malware.
Page 4 of 17