Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
51 detections
Filters
Last updated
All Time
Detection languages
23
8
7
3
3
Contributors
7
6
5
5
4
Categories
28
14
10
8
8
Platforms
24
12
11
6
5
Products / Services
8
7
5
5
4
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
CVEs
2
IDS Classtypes
1
1
IDS Protocols
2
Detects presence of persona-fabrication and identity-fraud enablement software (Wavebox, MEmu, eSIM Plus, Blacktel, insertFace, TrustID Card) via process, network, or file-system artifacts on an endpoint, consistent with PurpleDelta identity-fraud tradecraft.
Detects Android APK files that contain a combination of suspicious permissions and features often used for credential harvesting, specifically the binding of an accessibility service, SMS interception permissions, and overlay capability (System Alert Window).
This rule monitors for security alerts related to Azure AI services, specifically detecting credential theft attempts and LLM jailbreak attempts that have been blocked or detected by Azure's built-in content filtering mechanisms.
Infostealer distributed via fake open-source tool impersonation sites
Campaign converting compromised FortiGate firewalls into credential stealers
This rule monitors for security alerts related to Azure AI services, specifically detecting credential theft attempts and LLM jailbreak attempts that have been blocked or detected by Azure's built-in content filtering mechanisms.
Detects credential theft activity associated with VAPT (Vulnerability Assessment and Penetration Testing) frameworks, specifically looking for AI-generated payloads indicated by markers like 'VAPTb3gin', 'VAPTfin', and '__VAPTCMD__'. This rule also mentions 'SmartRAT' and 'Rokarolla' as key indicators, suggesting the use of specific tools or techniques often employed in such activities.
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
Identifies email attachments with a specific naming convention ('Agreement Settlement [Target] May [Day], 2026.pdf') used in a credential harvesting campaign. This rule looks for PDF files starting with 'Agreement Settlement' and ending with '.pdf', with a specific date format for May 2026.
This rule detects potential credential harvesting attempts by identifying a high volume of short-duration HTTP requests to common login, sign-in, verify, account, or authentication URI stems. It specifically looks for requests originating from user agents commonly associated with bots or scripting tools (e.g., 'bot', 'curl', 'python', 'powershell') and successful HTTP status codes (200). The 'short' session duration is inferred from small response sizes (less than 5000 bytes), suggesting automated access rather than human interaction.
Detects curl commands transmitting harvested GitHub tokens (ghp_ prefix) in the request body, representing the final exfiltration stage of gh-token-monitor.
This rule detects potential credential harvesting attempts by identifying a high volume of short-duration HTTP requests to common login, sign-in, verify, account, or authentication URI stems. It specifically looks for requests originating from user agents commonly associated with bots or scripting tools (e.g., 'bot', 'curl', 'python', 'powershell') and successful HTTP status codes (200). The 'short' session duration is inferred from small response sizes (less than 5000 bytes), suggesting automated access rather than human interaction.
Detects the creation of a systemd service explicitly named 'gh-token-monitor.service'. This service name is indicative of a credential harvester designed to run as a background daemon, likely targeting GitHub tokens or similar credentials.
Detects execution of installers for Binance, Bybit, MEXC, MetaTrader 5, or Exodus wallets loading CRYPTBASE.dll, linked to credential theft campaigns.
This rule detects a rapid succession of HTTP POST requests to a URI containing 'login' from the same source IP address, indicating a potential credential stuffing or brute-force attack. It triggers an alert if 20 such attempts occur within a 30-second window.
Detects rundll32.exe or dllhost.exe performing remote thread injection into web browser processes (chrome.exe, msedge.exe, firefox.exe). This activity is often associated with defense evasion and credential theft staging, as observed in campaigns like ClearFake/ClickFix, before a full Remote Access Trojan (RAT) is established.
This rule detects potential credential harvesting attempts by monitoring HTTP POST requests that contain both 'password' and 'email' in the client body. It specifically looks for these keywords in a case-insensitive manner within the HTTP client body and requires the body size to be greater than 50 bytes. This indicates a form submission likely containing sensitive user credentials.
Detects inbound emails containing Mailchimp click-tracking links that redirect to ActiveCampaign landing pages, a known ESP chaining technique used to obscure credential harvesters. This technique is often used in phishing campaigns to bypass email security controls.
Identifies processes launched with the __DAEMONIZED=1 environment variable. This specific marker is used by the vpmdhaj malicious npm packages to spawn their stage-2 credential harvesting payload as a detached process, allowing it to survive parent termination.
Detects the execution of the TruffleHog secret scanning tool. This tool is often used by attackers to find sensitive information like credentials in various data sources (filesystems, Git repositories, cloud storage, etc.). This rule identifies the process creation of TruffleHog and categorizes the type of scan being performed. It includes exclusions for legitimate CI/CD environments or security scanners.
KQL Query from file: KQL Detection for MDI Password Protection Insight
Page 1 of 3