Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,456
11,839
5,876
5,155
4,865
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects a user-mode process attempting to set an opportunistic lock (oplock) on wermgr.exe within a Volume Shadow Copy (VSS) snapshot. This behavior is associated with the RoguePlanet exploit chain (CVE-2026-50656), which leverages VSS snapshots and file locking to trigger a TOCTOU race condition against the Microsoft Defender (MsMpEng.exe) scanner.
Detects instances where files located in root or non-standard paths are opened by processes that are not core Windows system processes or Microsoft security products, which may indicate suspicious activity such as manual file interaction or discovery.
This rule monitors for Node.js processes accessing sensitive configuration files, environment files, or credential stores (such as AWS credentials). It also triggers when command line arguments or file contents contain patterns indicative of infostealer activity, including specific indicators related to the Polymarket campaign or credentials collection functions like Git or Docker credential harvesting.
Detects instances where the Active Directory domain database file (ntds.dit) is accessed by processes other than known legitimate tools such as lsass.exe or ntdsutil.exe. This activity is a strong indicator of credential dumping attempts to extract Active Directory hashes.
Detects the EKZ Stealer malware (masquerading as 'FortiEndpoint_Patch.exe') attempting to access sensitive web browser files ('Login Data' and 'Local State') used to store credentials, and subsequently writing stolen information to 'C:\ProgramData\log.txt'.
Detects malicious activity associated with the exploitation of StreamBucket PHP vulnerabilities. The rule monitors for unexpected child processes spawned by PHP/web server processes, the creation of specific exploitation artifact files in /tmp, unauthorized reading of /proc/self memory files by PHP, and inbound SOAP-related HTTP requests.
This rule detects non-Mozilla processes that systematically access sensitive Firefox browser files such as logins.json, key3.db, key4.db, and cookies.sqlite. Repeated access by processes not associated with the Mozilla Corporation or the Firefox browser suite is indicative of credential harvesting attempts by malicious software.
Detects unauthorized access, copy, or read operations against Chromium-based browser cookie database files by processes other than standard browsers. This behavior is indicative of session hijacking, a technique observed in malware like TONResolver and Millenium RAT to extract authentication tokens for subsequent adversary-in-the-middle or session theft attacks.
Detects unauthorized or suspicious processes reading sensitive credential files (AWS, .env, etc.) and subsequently initiating a successful network connection to an external destination within a 5-minute window. This behavior is a common indicator of credential exfiltration.
This rule detects shell commands (bash, sh, zsh) initiated by AI-agent or development-related processes (e.g., Python, Claude Desktop, openclaw) that target sensitive macOS paths associated with credentials, SSH keys, crypto wallets, and browser cookies, a technique characteristic of the Atomic Stealer (AMOS) malware.
Detects unauthorized processes (Node.js or Python) attempting to read sensitive browser credential files or access browser profile directories, often indicative of credential theft malware such as BeaverTail or InvisibleFerret.
Detects potential data exfiltration by monitoring interpreter processes (Python, Node.js) that access sensitive local credential/configuration files and subsequently connect to known cloud storage or code repository APIs (Dropbox, GitHub, Google Cloud). The rule correlates file access events with network connection activity.
Detects instances where scripting engines (Python or Node.js) access known SSH private key files and subsequently initiate a successful network connection to a non-private IP address within a 60-second window. This behavior is indicative of potential credential exfiltration or unauthorized remote access.
Detects instances where the Windows Error Reporting process (wermgr.exe) attempts to open files located within a Volume Shadow Copy path. This behavior is atypical and may indicate an attempt to access sensitive files from a shadow copy, a technique often used in credential dumping or discovery activities.
Detects unauthorized non-browser processes accessing Chrome Local State, Cookies, or Login Data files. This activity is indicative of credential harvesting by infostealers, such as the Glove Stealer/Yuta campaign, attempting to bypass App-Bound Encryption (ABE) by accessing browser configuration and data stores.
Detects unauthorized access to browser credential databases, cloud configuration files, and developer secret stores by processes spawned from Node.js or npm. This behavior is indicative of IronWorm and similar infostealers exploiting malicious npm package preinstall hooks to harvest sensitive developer credentials.
Detects the use of legitimate Windows system utilities (ntdsutil.exe, vssadmin.exe, esentutl.exe) to interact with the Active Directory database file (ntds.dit). This behavior is commonly associated with offline credential harvesting, where an attacker attempts to create a copy of the database to extract hashes offline.
This rule detects scenarios where Microsoft Teams initiates a potential screen-sharing session (via outbound network connections on specific ports) followed shortly by the access of VPN configuration files on the same host. This sequence may indicate an attacker using screen-sharing to view credentials or configuration details and subsequently attempting to utilize a VPN client.
Detects Node.js, NPM, or NPX processes attempting to read sensitive shell history files (e.g., .bash_history, .zsh_history). This behavior is characteristic of malicious activity such as infostealers attempting to harvest credentials or reconnaissance data from a compromised developer environment, notably observed in supply chain campaigns like the Polymarket Trap.
Detects Python processes (potentially associated with the ChocoPoC RAT, slogsec, or logcrypt modules) performing file read or access operations against common browser credential store files such as Login Data, Cookies, and Web Data on Windows and macOS systems.
Detects clipboard access operations (Read/Write) initiated by common web browsers (Chrome, Edge, Brave, Electron-based apps) when running with specific command-line arguments typically associated with renderer or extension processes. This can indicate malicious code or browser extensions attempting to monitor or steal sensitive clipboard content.
Page 40 of 76