Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Clipboard hijacking malware for cryptocurrency address substitution
This rule detects the execution of common archival utilities (7-Zip, WinRAR, RAR, ZIP) with parameters indicative of password-protected archive creation. It specifically flags instances where a user account, with no recorded prior history of running these utilities in the last 30 days, creates a large archive (exceeding 1GB) spanning multiple directories. This pattern is commonly used for data staging and preparation prior to exfiltration.
This rule detects the BQT.exe (BQTLock ransomware) process attempting to access web browser credential files (Chrome, Firefox, Opera) or creating a password staging file in the Windows Temp directory. This behavior is indicative of credential theft performed by the ransomware prior to or during the encryption process.
Teampcp Shell Recon
YARA-L
Tracks shell reconnaissance parsing /var/log/auth.log for successful logins or executing env | grep AWS_.
Detects instances where a Node.js process accesses or modifies browser-related credential, cookie, or configuration files. This behavior is indicative of unauthorized data collection or credential harvesting from locally stored web browser profiles.
Detects Node.js processes executing command-line arguments related to the collection of sensitive configuration files, credentials, and identity tokens from systems, such as Git configurations, SSH keys, NPM credentials, and Docker tokens. This behavior is indicative of an automated reconnaissance or credential harvesting phase in an attack.
This rule detects cross-process memory access events (Sysmon Event ID 10) where a process attempts to hook into keyboard-related Windows API functions such as SetWindowsHookEx, GetKeyState, or GetAsyncKeyState. It further filters for processes executing from suspicious locations (Temp, AppData, ProgramData) or those that are unsigned/unverified, which are common indicators of malicious keylogging or spyware activity.
This rule detects instances where a Node.js process accesses sensitive files associated with web browsers (e.g., Login Data, Cookies) or SSH keys (e.g., id_rsa). This behavior is often indicative of credential theft or unauthorized data collection, where an adversary uses legitimate tooling like Node.js to stage or exfiltrate sensitive local files.
Detects node.exe (or node) processes accessing standard shell history files across Linux (.bash_history, .zsh_history, .sh_history, fish_history) and Windows (PSReadLine history). This behavior is characteristic of infostealer payloads, such as those observed in the Polymarket Trap npm supply chain campaign, attempting to collect sensitive command-line history.
Detects unauthorized file read activity by node.exe targeting browser-based crypto wallet vault files, specifically 'Local Extension Settings'. This behavior is consistent with infostealer malware (such as Miasma/MYRA) using malicious JavaScript payloads to harvest sensitive encrypted vault data from developer environments.
Detects the execution of Python scripts that include libraries (pynput, pyxhook) or functions (GetAsyncKeyState, WH_KEYBOARD_LL) frequently used by keyloggers to capture user keystrokes. It also monitors for suspicious input device access and command-line arguments indicative of keystroke monitoring.
This rule detects non-standard processes (not identified as common web browsers) accessing browser extension configuration files associated with cryptocurrency wallets (MetaMask or Coinbase Wallet). The rule triggers when a process performs file I/O on multiple distinct extension configuration paths, and the initiating process is associated with build-time or package management tools like Node.js, npm, or Git, which may indicate malicious activity related to supply chain attacks or credential theft from browser storage.
This rule detects a process initiated by Node.js or NPM performing a DNS lookup for known malicious domains while simultaneously accessing sensitive local files such as SSH keys, AWS credentials, browser cookies, browser login data, or bash history. This pattern is indicative of a post-compromise activity where an adversary leverages a JavaScript runtime to perform credential theft and communicate with C2 infrastructure.
This rule detects when a Node.js process accesses sensitive files associated with SSH configurations, private keys, or package manager credentials (such as .npmrc or .pypirc). Such behavior is highly unusual for legitimate web application processes and may indicate an attacker attempting to steal credentials or secrets from a compromised system.
This rule detects unauthorized access or modification attempts to the Microsoft WinGet DSC (Desired State Configuration) configuration history database and associated YAML configuration files. WinGet stores execution history and DSC configuration files in specific directories; unauthorized processes interacting with these files may indicate an attempt to gain persistence, escalate privileges, or conduct reconnaissance on configured system states by inspecting or tampering with deployment manifests.
This rule detects unauthorized or suspicious processes accessing sensitive files within the Linux /proc filesystem or application-specific directories (such as graph_api.py, main.py, or requirements.txt). By excluding standard administrative tools like systemd, rpm, dpkg, and apt, this rule highlights processes that may be performing reconnaissance, credential harvesting, or attempting to read source code in an abnormal manner.
Detects AstarionRAT installing a global keyboard hook (SetWindowsHookEx) to capture user keystrokes. This rule relies on advanced API tracking telemetry to identify the SetWindowsHookExApiCall action type and then joins with process events to filter for executables running from the AppData folder.
Detects access to sensitive GCP credential-related files or the presence of credential-related environment variables/secrets in command lines and network request bodies. This pattern is often associated with the theft of service account keys or environment-based cloud credentials, frequently seen in serverless or containerized environments.
Detects the creation of files in the 'C:\ProgramData\Windows Multimedia\' directory, specifically files named 'ROG', which is indicative of JFMBackdoor staging captured screenshots using GDI+ functions.
This rule detects web browser processes (Chrome, Edge, Brave, Electron) making network requests to 'raw.githubusercontent.com' that contain keywords indicative of sensitive data, such as 'credential', 'secret', 'password', 'token', 'api_key', or '.env'. This behavior may indicate an adversary attempting to download configuration files or sensitive credentials hosted on GitHub.
Detects NTLM-authenticated network logons (Logon Type 3) originating from loopback IP addresses (127.0.0.1, ::1, or 0.0.0.0). This behavior is often associated with NTLM relay attacks or credential reflection bypass techniques where an adversary forces a local service to authenticate to itself to gain unauthorized access.
Page 102 of 173