Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
This rule detects suspicious activity involving Node.js or Bun runtimes, specifically focusing on the access of sensitive configuration files (e.g., .npmrc, .aws/credentials, .ssh, .kube/config) or the execution of commands containing keywords associated with credential harvesting and automated data collection scripts.
Detects rapid access (three or more distinct files within a 60-second window) to sensitive files typically containing credentials or configuration data (e.g., SSH keys, AWS credentials, environment files, container configurations). This pattern is often associated with credential dumping or reconnaissance activity by an adversary attempting to harvest secrets.
Detects the use of the WinRAR utility to archive sensitive directories (like backup folders, web root directories, or VMware configuration data) using common flags associated with command-line archiving. This behavior is often indicative of data staging for exfiltration.
Detects instances where 'node' or 'bun' runtime processes access multiple sensitive developer configuration or credential files (e.g., .ssh, .aws/credentials, .npmrc, .kube/config). This behavior is indicative of potential credential theft or reconnaissance activities by an adversary attempting to leverage developer environments.
Detects the spawning of svchost.exe processes from parent processes associated with Windows Mixed Reality or NvdaHelperRemote, which may indicate malicious process injection or suspicious use of GDI screen capture APIs within a masqueraded service context.
Detects the creation, modification, or deletion of the 'C:\debug.txt' file, which is an artifact associated with the DcRAT malware's screen capture module. The rule specifically monitors for this file's activity and highlights when the deletion is performed by 'svchost.exe', a common process used for masquerading malicious activity.
Detects modification of /etc/ld.so.preload to register the MYRA RAT rootkit shared library (.libcache.so) for system-wide LD_PRELOAD injection. The MYRA npm package (apintergrationpost) copies libcache.so to /usr/local/lib/.libcache.so and appends its path to /etc/ld.so.preload, causing the rootkit to load into every new process on the system.
Detects instances where the node.exe process attempts to read SSH configuration files or private key files (id_rsa, id_ed25519, etc.). This behavior is often associated with malicious packages or compromised scripts attempting to exfiltrate SSH credentials from the local file system. The rule includes exclusions for common node package manager installation paths and processes that appear to be performing legitimate package management or post-installation tasks.
This rule monitors for potential keylogging behavior by detecting the use of Windows hooks (SetWindowsHookEx, GetAsyncKeyState), the creation of files named 'keylogger.dat' or 'keylogger', and files created in AppData with a .dat extension by unauthorized processes. It includes exclusions for common legitimate system and application processes to minimize noise.
Detects suspicious processes accessing, reading, or deleting browser credential stores (like 'Login Data', 'cookies.sqlite'). The rule specifically monitors for patterns where non-browser processes interact with these files, particularly when both file read and deletion actions are observed, which is a technique used by Remcos RAT to wipe existing sessions and force re-authentication for harvesting.
Detects the node.exe process attempting to read shell history files (.bash_history, .zsh_history, etc.), which are common targets for credential harvesting by malicious npm packages. This behavior is associated with the Polymarket Trap campaign involving Miasma and MYRA infostealers.
Detects node.exe processes attempting to access sensitive browser credential databases, such as cookies, login data, or key databases. This pattern is indicative of infostealer malware, specifically those associated with the Polymarket Trap supply-chain campaign, which abuse node.js processes to exfiltrate browser data.
Detects the creation of a 'keylogger.dat' file within the Windows APPDATA Roaming directory. This specific file path is a known artifact generated by Remcos RAT when utilizing its offline keylogger capability, which relies on the SetWindowsHookExA API with the WH_KEYBOARD_LL hook to intercept keystrokes.
Detects a single process reading both SSH private keys and various developer-sensitive configuration or credential files (e.g., .aws/credentials, .npmrc, .pypirc) on a single host. This behavior is consistent with infostealer activity, such as the Miasma JavaScript infostealer used in supply chain campaigns, aiming to harvest credentials from developer workstations.
Detects the Polymarket Trap / Miasma JavaScript-based infostealer attempting to access sensitive configuration files and credentials (SSH keys, AWS credentials, .npmrc, .pypirc, Docker config, and GPG keys) from a developer's workstation using node.js-related runtimes.
This rule detects the Miasma infostealer activity by monitoring for Node.js processes directly reading sensitive browser credential and cookie databases (e.g., 'Login Data', 'Cookies', 'logins.json') associated with Chrome, Brave, Chromium, and Firefox. The detection targets the behavior where malicious scripts use tools like sql.js to parse and harvest these local files for exfiltration.
Detects instances where a Node.js process accesses sensitive shell history files (e.g., .bash_history, .zsh_history) or the PowerShell PSReadLine history file (ConsoleHost_history.txt). Such activity may indicate an attempt by a malicious script or attacker to harvest credentials or commands stored in shell history.
Detects node.exe or node process accessing sensitive SSH private key files or configuration files. This behavior is indicative of unauthorized credential harvesting by malicious npm packages or infostealer malware like Miasma/MYRA attempting to exfiltrate developer secrets.
Detects instances where a Node.js process accesses or interacts with common web browser credential files, such as 'Login Data', 'Cookies', or 'key4.db'. This behavior is characteristic of credential-stealing malware or unauthorized collection scripts targeting browser-stored data.
This rule detects an unusually high volume of access attempts (20 or more within an hour) to a user's 'Documents' or 'Desktop' folders. This activity could indicate an adversary attempting to discover or collect sensitive data.
Detects Node.js processes (node, npm) attempting to access sensitive files typically associated with web browser extensions, cryptocurrency wallets, or stored secrets. This activity is indicative of credential theft or data exfiltration attempts.
Page 104 of 173