Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
340 detections
Filters
Last updated
All Time
Detection languages
121
95
28
25
18
Contributors
111
38
29
22
22
Categories
228
127
108
46
28
Platforms
255
58
57
11
10
Products / Services
77
70
29
21
17
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
CVEs
2
2
1
1
1
IDS Classtypes
7
1
IDS Protocols
8
Detects anomalous credential access behavior in Azure Key Vault where a single identity performs more than 20 secret, key, or certificate read/list operations within a 5-minute window. This behavior is indicative of potential unauthorized reconnaissance or exfiltration of secrets stored in Key Vaults, excluding known automation service principals.
Detects non-Steam processes accessing Steam configuration files (e.g., config.vdf, loginusers.vdf, ssfn files) and reading Steam-related registry keys. This behavior is indicative of infostealer malware attempting to hijack Steam sessions or exfiltrate account configuration data.
Detects unauthorized attempts to enumerate stored Windows credentials using native command-line utilities such as vaultcmd.exe and cmdkey.exe, or by invoking CredEnumerate/Get-StoredCredential functions via PowerShell scripts. These methods are commonly used by attackers to gain access to cached passwords, tokens, or network credentials stored in the Windows Credential Manager.
Detects suspicious access to browser credential stores (Google Chrome, Microsoft Edge, Mozilla Firefox, Brave) by non-browser processes within a short time frame (2 hours) after a FortiClient VPN logon event. This activity is consistent with information stealer malware, such as LummaC2, Phantom Stealer, Aurora Stealer, Luca Stealer, and Formbook, often observed in post-compromise phases of campaigns like FortiBleed.
This rule detects suspicious activity where a process attempts to access browser credential files (e.g., login data, cookies) shortly after a VPN logon event on the same device and by the same user. This could indicate an attacker attempting to steal credentials after gaining initial access or establishing a VPN connection.
Detects the unique session ID prefix 'xc32038474a' used by the INFINITERED credential harvester. The malware prepends this string to hide stolen plaintext passwords inside the legitimate REDCap sessions database table, which can be observed in process command line executions.
Detects unauthorized or suspicious access to sensitive files (AWS credentials, config, or SSH private keys) by processes spawned as children of common Integrated Development Environments (IDEs) or language runtimes. This pattern is characteristic of exploit chains like CVE-2026-12957, where malicious workspace configurations trigger automatic server execution, inheriting developer environment access to sensitive credential stores.
Fraud framework powering scam domains for crypto and gambling schemes
Credential and browser data stealer distributed via OXLOADER campaigns
Detects unauthorized processes attempting to access sensitive browser files such as Login Data, Cookies, or Web Data for Google Chrome or Microsoft Edge. This activity is indicative of credential theft, where malicious actors attempt to extract stored passwords or session cookies from web browsers.
Detects processes that access a threshold of five or more sensitive configuration, credential, or browser-stored login files within a single execution context, which is indicative of credential harvesting or automated collection activity.
Detects instances where Node.js or NPM processes (or their parent processes) access sensitive files such as SSH private keys, AWS credentials, environment files, or configuration files containing secrets. This behavior is often associated with infostealers or malicious scripts exfiltrating credentials from developer environments.
Detects instances where a node.exe process accesses files located within directories associated with popular browser-based cryptocurrency wallets. This pattern is commonly observed in infostealer malware campaigns that target wallet seeds, keys, and browser credentials stored in extension local storage or browser profile paths.
Detects suspicious execution of Python or shell scripts (bash, zsh, sh) from paths associated with 'openclaw' or 'clawhub' that are interacting with sensitive data files, including browser credential stores (Chrome, Firefox, Edge, Brave), system keychains, and cryptocurrency wallet files.
Detects unauthorized attempts to enumerate stored Windows credentials using native command-line utilities such as vaultcmd.exe and cmdkey.exe, or by invoking CredEnumerate/Get-StoredCredential functions via PowerShell scripts. These methods are commonly used by attackers to gain access to cached passwords, tokens, or network credentials stored in the Windows Credential Manager.
Detects unauthorized processes attempting to access Outlook or Windows Messaging Subsystem profile registry keys. This behavior is indicative of infostealer malware, such as StealC, attempting to harvest stored email client credentials.
Detects Python-based processes accessing sensitive local cryptocurrency wallet files and directories, including MetaMask extension storage, Exodus wallet, and Bitcoin wallet files, which are known targets of the InvisibleFerret infostealer.
Detects behavior indicative of the AMOS (Atomic macOS) infostealer, where a malicious process uses 'osascript' to display a fake System Preferences password prompt to the user and then attempts to validate the harvested credentials using 'dscl -authonly'.
Detects the execution of psql.exe with arguments pointing to a VeeamBackup database, or suspicious database queries containing 'credentials' or 'SELECT' statements. The rule specifically alerts when this behavior is initiated by PowerShell or WMI processes, which are common indicators of automated post-exploitation activities intended to extract sensitive information from the backup infrastructure.
Detects unauthorized attempts to access or interact with the Veeam Backup database, including psql.exe direct queries, PowerShell scripts attempting to decrypt credentials using DPAPI, and encoded PowerShell commands launched from cmd.exe that target the Veeam environment.
Detects remote SMB access (Event ID 5145) to sensitive file paths where credentials are commonly stored, including DPAPI master keys, browser profiles, cloud provider configuration directories, and password manager data. This activity often indicates unauthorized credential discovery and staging during lateral movement or post-compromise reconnaissance.
Page 9 of 17