Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Identifies the use of the macOS ditto utility to compress stolen datasets into a single archive, specifically preserving resources, as observed in AMOS malware activity.
Detects a web session that proxies an enterprise authorisation endpoint while also handling session-cookie names associated with authenticated access. This rule identifies suspicious activity indicative of an Adversary-in-the-Middle (AiTM) attack where an attacker proxies authentication requests and steals session cookies.
Detects one web session posting username, password, and MFA or one-time-code form fields through the same intermediary host. This behavior is indicative of an Adversary-in-the-Middle (AiTM) attack, where an attacker intercepts and relays authentication requests, including multi-factor authentication (MFA) codes, to gain unauthorized access.
Detects the VSCode executable making direct web requests to the GitHub API. This may indicate a malicious extension exfiltrating or validating stolen OAuth tokens, as demonstrated in the 1-click GitHub Dev/VSCode webview attack.
Detects the use of the PowerShell 'Compress-Archive' cmdlet to archive files within user-writable temporary or application directories. This behavior is often indicative of an attacker staging data prior to exfiltration.
Detects anomalous screen capture activity associated with StealC malware. It identifies when a non-UI process creates a JPEG file within the system temporary directory followed immediately by an outbound network connection from the same process, which is indicative of the malware capturing a screenshot and staging it for exfiltration.
This rule detects network communication with infrastructure associated with the 'EvilTokens' phishing kit, specifically targeting Microsoft OAuth device code API endpoints (/api/device/*) hosted on workers.dev. This behavior is indicative of an adversary conducting device code phishing (a form of AitM attack) to obtain unauthorized access tokens.
Detects the use of archive utilities (tar, zip, 7z, gzip, zstd) to bundle sensitive PeopleSoft configuration and application directories (e.g., ps_config_homes, psoft/psft). This behavior is consistent with data staging for exfiltration, frequently associated with the ShinyHunters threat group activity targeting exposed PeopleSoft environments.
Detects the use of the zstd compression utility on PeopleSoft application servers by privileged service accounts such as psoft, oracle, or linuxadm. This behavior is indicative of data staging or archiving activity consistent with ShinyHunters pre-exfiltration tactics.
Detects the creation or modification of a specific log file at AppData\Roaming\DT\logs.dat on Windows systems, a known indicator of behavior associated with the Remcos Remote Access Trojan (RAT) for capturing and storing keystrokes.
Detects unauthorized file read operations targeting local cryptocurrency wallet directories and browser extension storage (MetaMask, Phantom, etc.) by suspicious processes (e.g., node.exe, chost.exe) or processes executing from temporary or user-writable application directories, commonly associated with infostealer malware.
Detects a spear-phishing email masquerading as AWS Support services originating from a specific compromised university account (awsservices@presby.edu). This rule identifies malicious emails associated with the PoisonSeeds AiTM (Adversary-in-the-Middle) phishing campaign, which uses support ticket lures to harvest credentials.
Detects execution of potential keylogging software from suspicious paths like AppData or Temp, followed by the creation of a keylogger log file artifact in the specific AppData\Roaming\DT\ directory.
Detects the execution of the macOS 'ditto' command used to compress and stage files into the /tmp directory, specifically looking for the creation of zip archives. This behavior is associated with Amos Stealer prior to data exfiltration.
Identifies the clipper writing wallet seed phrases.
Detects attempts to copy sensitive configuration or credential files (e.g., .ssh, .zshrc, .bash_history, .gitconfig, .kube, .aws) to a suspicious temporary directory '/tmp/sync' on macOS systems using common shell commands like 'cp', 'bash', 'zsh', or 'sh'. This activity could indicate an adversary staging data for exfiltration or further malicious use.
Detects the creation of specific folders in AppData used to host the unpacked malicious extension locally, specifically looking for 'manifest.json' within an AppData\Local path, in conjunction with the execution of '7za.exe' (7-Zip archiver). This combination indicates the potential unpacking and setup of a malicious browser extension for sideloading, as observed in UnregStealer campaigns.
Detects the use of tar.exe to extract archives into common staging directories (Temp, AppData, Public, ProgramData), particularly when the process is initiated by suspicious parent processes such as Office applications, command shells, or download utilities, which is often indicative of malicious payload staging.
Detects unauthorized access (File Creation, Modification, Rename, or Deletion) to common web browser cookie and credential storage files by non-browser processes. This behavior is a common indicator of information-stealing malware attempting to extract session cookies and credentials for later use.
Detects automated scripts generating large volumes of text or markdown documents in corporate sync folders (OneDrive/SharePoint) designed to flood the AI indexer with poisoned recommendations.
This rule detects attempts by unsigned or suspicious processes (often residing in temporary directories) to access sensitive cryptocurrency wallet files such as 'wallet.dat', keystore JSON files, and files containing recovery seed phrases. This behavior is indicative of credential theft commonly associated with infostealer campaigns like DeepLoad and DeerStealer.
Page 112 of 173