Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
This rule detects the creation of a specific file named 'linux-process-env.json' on Linux endpoints. The creation of environment-related configuration files in unexpected locations or by unauthorized processes may indicate reconnaissance, staging of malicious configuration, or post-exploitation activities by an adversary.
Detects unauthorized processes reading, creating, or modifying sensitive files associated with local AI development tools and assistants (e.g., Claude, Codex, Gemini, Cline, Opencode, Kilo). This rule monitors for file operations outside of the known, legitimate AI tool processes, suggesting potential credential theft or configuration tampering by malicious software.
Detects unauthorized mass access to AI development tool configuration files and credentials. The rule identifies processes reading sensitive files associated with tools such as Claude (mcp.json, projects), Codex (config.toml, sessions), Gemini (settings.json, .env), Cline, OpenCode, and Kilo.
This rule detects attempts by unsigned or suspicious processes (often residing in temporary directories) to access sensitive cryptocurrency wallet files such as 'wallet.dat', keystore JSON files, and files containing recovery seed phrases. This behavior is indicative of credential theft commonly associated with infostealer campaigns like DeepLoad and DeerStealer.
Detects potential BeepRAT malware activity characterized by a process executing from a non-standard directory, writing suspicious artifacts like images or encrypted files to the AppData folder, and initiating frequent outbound network connections typical of command-and-control beaconing.
Detects the Djinn Stealer malware accessing sensitive configuration files and credential stores related to AI coding assistants (e.g., Claude, Codex, Gemini, Cline) and common development utilities (e.g., AWS, GKE, SSH) on Linux workstations. It also detects the creation of a 'linux-process-env.json' file, which is an artifact used by the stealer to exfiltrate environment variables harvested from process memory.
This rule detects instances where Python interpreter processes (python.exe, python3.exe) access sensitive cryptocurrency wallet or keystore files. This behavior is indicative of unauthorized information collection or wallet stealer malware activity targeting local system assets.
This rule detects potentially malicious clipboard data access by scripting engines (Python, Node.js) and command-line utilities (xclip, xdotool, PowerShell). It monitors for specific API calls, module imports, or command arguments that signify reading or interacting with the system clipboard, often used by malware for credential theft or data exfiltration.
Detects instances where common script interpreters (node.exe, python.exe, etc.) simultaneously access sensitive local credential files and establish outbound network connections to common web ports (80, 443, 8080, etc.), which is indicative of credential exfiltration behavior.
Detects cloud searches for credential, key, production, database, or confidential terms followed by access to matching files within OneDrive.
Detects a banking trojan invoking SendInput, mouse_event, keybd_event, or related APIs to control the victim session. The rule specifically looks for process events where the filename matches common RAT names (banana, client, update, service) and the command line contains API calls related to input injection.
Detects creation of Remcos RAT keylogger output file AppData\Roaming\DT\logs.dat by a non-browser process or a browser process indicating process hollowing
Detects potential unauthorized or rogue peer connections within a Cisco SD-WAN infrastructure. The rule monitors certificate-based authentication events for indicators of rogue peers (e.g., certificate mismatches, invalid common names) or connections originating from known malicious IP addresses associated with rogue SD-WAN activity.
Detects potentially unauthorized or malicious behavior associated with the RustDesk remote access tool. The rule monitors for unsigned screen capture attempts, spawning of shell or scripting processes, cross-process input injection, and network communication over non-standard or unexpected ports.
Detects evil twin access point credential capture portal
Detects outbound network traffic from common web browsers (Chrome, Edge, Brave, etc.) to the typosquatted domain 'perplexity-ai.online'. This rule identifies behavior associated with a malicious browser extension ('Search for perplexity ai') that exfiltrates keystrokes and search queries captured via the browser's Omnibox functionality to an attacker-controlled server.
This rule detects when a non-Outlook process running as SYSTEM accesses or creates PST or OST mailbox data files. The logic specifically excludes legitimate Outlook, searchindexer, or searchprotocolhost activity to focus on suspicious mailbox collection sequences.
This rule detects suspicious staging activity by monitoring for the creation of 'editor.dat' files in sensitive directories like C:\Users\Public or C:\Windows\Tasks, or the rapid accumulation of multiple executable files (.exe, .dll, .cpl) within the C:\Users\Public directory, which is a common technique used by attackers to stage tools before execution or lateral movement.
This rule detects suspicious staging activity by monitoring for the creation of 'editor.dat' files in sensitive directories like C:\Users\Public or C:\Windows\Tasks, or the rapid accumulation of multiple executable files (.exe, .dll, .cpl) within the C:\Users\Public directory, which is a common technique used by attackers to stage tools before execution or lateral movement.
This rule detects potentially malicious activity involving the WinRAR utility. It monitors for WinRAR creating files in Windows Startup folders, dropping files in specific ProgramData subdirectories often associated with staging malicious payloads, and spawning suspicious child processes such as command shells, scripting engines, or HTML applications.
Detects access or modification attempts to KeePass (.kdbx) password database files by processes other than authorized KeePass applications. This behavior often indicates an attempt to exfiltrate or crack credential stores.
Page 107 of 173