Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,443
11,831
5,875
5,151
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects potential activity related to the SectopRAT loader by monitoring the execution sequence of 'ReportDump.exe'. The rule identifies the side-loading of a specific DLL ('sdkcra.dll') followed by the process reading a known configuration or database file ('pool.db') within a short time window, which is indicative of the loader's secondary decryption phase.
Detects the granting of highly privileged OAuth or API scopes to AI-related applications (such as Copilot plugins, browser-automation agents, or AI connectors) immediately followed by high-volume data access activities (file reads or email transfers) performed by the same user account. This behavior is indicative of an attacker weaponizing a compromised identity to grant an external AI agent broad access to sensitive data for exfiltration or automated reconnaissance.
Detects anomalous large-volume file download or export activity from cloud repositories (SharePoint, OneDrive, or Salesforce) occurring shortly after a help-desk-mediated credential or MFA reset for the same user. This behavior is indicative of account takeover, specifically vishing-to-exfiltration patterns used by threat actors.
This rule detects unauthorized or suspicious processes (like Python scripts or random executables) accessing Telegram Desktop's local 'tdata' directory, which contains user session information, and simultaneously exhibiting network activity directed towards Telegram API domains. This behavior is highly indicative of infostealer activity, where a malicious process attempts to harvest local Telegram session data for exfiltration.
This rule detects processes accessing or modifying Microsoft Outlook data files (.pst or .ost), which may indicate an attempt to collect, stage, or export sensitive email data from a local system.
Detects access, reading, or modification of sensitive credential files (such as KeePass databases, VPN profiles, private SSH keys, and certificates) by a process. This behavior is often associated with pre-encryption staging for data exfiltration during ransomware attacks.
Detects the Perplexity Comet or Google Chrome browser processes accessing files in locations outside expected directories (such as Downloads, User Data, or Temp), which is a common indicator of a malicious browser extension or process attempting to read arbitrary files from the filesystem.
Detects individual file access events performed by non-browser python processes. This rule is designed as a proxy to identify automated file collection activities, such as those performed by 'python-httpx', that may be indicative of low-volume data exfiltration when aggregated over time.
Detects evidence of PSNATCH or BASHNATCH tools exfiltrating data to GitHub. The rule identifies suspicious file operations related to an 'SmartUploader' tracking file in standard user directories (AppData, .local/share), monitors for SmartUploader process execution, and flags network connections to api.github.com from processes identified as SmartUploader, bash, or PowerShell.
Detects the Comet browser process, typically associated with AI-agent operations, accessing sensitive browser profile files (e.g., History, Bookmarks, Login Data, Cookies) followed by outbound network communication within a 15-minute window, excluding known legitimate paths.
Detects the Comet browser process, typically associated with AI-agent operations, accessing sensitive browser profile files (e.g., History, Bookmarks, Login Data, Cookies) followed by outbound network communication within a 15-minute window, excluding known legitimate paths.
Detects the creation of a Volume Shadow Copy followed by an attempt to access or copy the Active Directory database file (ntds.dit) from the shadow copy. This pattern is commonly used by adversaries to perform offline credential dumping.
Detects the creation of a Volume Shadow Copy followed by an attempt to access or copy the Active Directory database file (ntds.dit) from the shadow copy. This pattern is commonly used by adversaries to perform offline credential dumping.
This rule detects file access events targeting sensitive files such as credential stores, configuration files (e.g., .env, config.yaml, wallet.dat), and AWS credential files. This is indicative of an adversary searching for stored secrets or configuration data to facilitate further lateral movement or privilege escalation. The rule excludes common developer tools like code editors and file explorers to reduce noise.
Detects a sequence of events consistent with credential dumping of sensitive Windows registry hives (SAM, SYSTEM, SECURITY). The attack involves querying shadow copies using vssadmin, creating a symbolic link to the shadow copy volume via mklink, and copying the hive files from that location. Cleanup attempts using rmdir are also monitored.
This rule detects malicious activity associated with the Bazinga macOS backdoor, specifically focusing on the clearing of TCC privacy permissions, the staging of keychain and browser data using 'ditto', and the subsequent exfiltration of this data to a remote host via 'curl'.
Detects rapid, multi-category system and network enumeration performed by AI-assisted development tools (e.g., Cursor, Claude, ChatGPT). The rule triggers when an AI agent process performs a comprehensive scan of the host environment, specifically covering machine/OS identity, network configuration, process listings, installed software, and access to sensitive credential files within a 10-minute window. It requires at least 5 distinct discovery categories and 6 total events to reduce noise from routine debugging. Covers T1082, T1016, T1057, T1518
Detects suspicious file create or write operations within the domain SYSVOL Policies directory. This pattern is commonly associated with attackers attempting to deploy malicious payloads, such as ransom notes or configuration changes, via Group Policy Objects (GPO). The rule monitors Windows Event ID 4663 to identify unauthorized modification attempts by non-system accounts.
The following analytic detects unauthorized access to Outlook credentials stored in the Windows registry.
It leverages Windows Security Event logs, specifically EventCode 4663, to identify access attempts to registry paths associated with Outlook profiles.
This activity is significant as it may indicate attempts to steal sensitive email credentials, which could lead to unauthorized access to email accounts.
If confirmed malicious, this could allow attackers to exfiltrate sensitive information, impersonate users, or execute further unauthorized actions within Outlook, posing a significant security risk.
It leverages Windows Security Event logs, specifically EventCode 4663, to identify access attempts to registry paths associated with Outlook profiles.
This activity is significant as it may indicate attempts to steal sensitive email credentials, which could lead to unauthorized access to email accounts.
If confirmed malicious, this could allow attackers to exfiltrate sensitive information, impersonate users, or execute further unauthorized actions within Outlook, posing a significant security risk.
Detects unauthorized access or file creation events targeting the 'tdata' directory, which stores local Telegram session and authentication data. The rule triggers when processes other than legitimate Telegram or system file explorers interact with these files, a common technique for session theft and account takeover.
Detects the RatHat Android malware component using getevent or direct access to /dev/input event files to capture user PINs and patterns. The rule filters for processes running under UID 2000 (shell) or identifying as liblocal-service, which are consistent with the malware's keylogging behavior.
Page 18 of 76