Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
252 detections
Filters
Last updated
All Time
Detection languages
109
48
29
20
15
Contributors
70
34
30
21
11
Categories
156
65
58
54
31
Platforms
129
107
62
33
16
Products / Services
39
36
27
19
18
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
5
4
2
1
1
IDS Classtypes
4
3
1
1
IDS Protocols
8
Detects a two-stage activity: first, the potential unauthorized reading or access of LLM provider API keys from files, environment variables, or command-line arguments; and second, the subsequent use of those same credentials to authenticate to LLM provider APIs (OpenAI, Anthropic, Azure, Bedrock) from a different, unrecognized source IP address, indicating potential credential theft and session hijacking.
Detects processes spawned by Terraform or Go (e.g., during init, apply, or run) that exhibit suspicious access to local cloud credential files (AWS/Azure/GCP) or Terraform state files. This behavior is indicative of a malicious module attempting to exfiltrate cloud credentials from a developer's workstation or a CI/CD build host.
Detects high-risk activities related to SAML token-signing certificates, including certificate export from Active Directory Federation Services (AD FS) or Active Directory Certificate Services (AD CS) and unauthorized configuration changes to enterprise application certificate management. These activities are potential precursors to Golden SAML attacks, where an adversary attempts to forge authentication tokens.
Detects the ingestion of sensitive credentials (API keys, passwords, private keys) into a RAG (Retrieval-Augmented Generation) document store, followed by the retrieval of those credentials by an application agent, indicating potential credential harvesting within the LLM application pipeline.
Detects anomalous, mass-access behavior targeting plaintext credential files, certificate stores, private keys, or password-manager databases located on general-purpose network shares. Such activity is often indicative of an adversary conducting discovery or collection of credentials for lateral movement and privilege escalation.
Detects the creation of 'auth_codes.json' files within directories containing 'seria' in their path. This file is known to be used to store MD5-derived 8-character hex recovery codes for Dahua devices, allowing for password bypass or recovery via the easy4ipcloud.com portal without valid credentials.
Detects a two-stage activity: first, the potential unauthorized reading or access of LLM provider API keys from files, environment variables, or command-line arguments; and second, the subsequent use of those same credentials to authenticate to LLM provider APIs (OpenAI, Anthropic, Azure, Bedrock) from a different, unrecognized source IP address, indicating potential credential theft and session hijacking.
Detects a two-stage activity: first, the potential unauthorized reading or access of LLM provider API keys from files, environment variables, or command-line arguments; and second, the subsequent use of those same credentials to authenticate to LLM provider APIs (OpenAI, Anthropic, Azure, Bedrock) from a different, unrecognized source IP address, indicating potential credential theft and session hijacking.
Detects instances where AI-assisted development tools (such as Claude, Codex, Copilot, or Gemini) initiate command-line processes (e.g., shells, interpreters, or network utilities) with arguments indicative of credential access, reconnaissance, or sensitive file interactions.
The detection rule monitors for access to files commonly used to store sensitive information, including .git-credentials, .netrc, and .gitconfig files configured to store credentials. Accessing these files is a common indicator of credential theft attempts by adversaries looking for plaintext authentication data to pivot to other systems or services.
Detects anomalous, mass-access behavior targeting plaintext credential files, certificate stores, private keys, or password-manager databases located on general-purpose network shares. Such activity is often indicative of an adversary conducting discovery or collection of credentials for lateral movement and privilege escalation.
This rule detects attempts to query or access the MachineGuid registry key located in HKLM\SOFTWARE\Microsoft\Cryptography. This registry key is commonly used to uniquely identify a Windows installation and is frequently targeted by malicious software to perform system identification or fingerprinting.
Detects a service principal or user account performing a burst of 'ListKeys' operations across multiple Azure Storage accounts. This behavior is indicative of an attacker attempting to dump access keys for multiple storage accounts after initial compromise or privilege escalation to gain further access to sensitive cloud data.
Detects a service principal or user account performing a burst of 'ListKeys' operations across multiple Azure Storage accounts. This behavior is indicative of an attacker attempting to dump access keys for multiple storage accounts after initial compromise or privilege escalation to gain further access to sensitive cloud data.
Detects instances where AI-assisted development tools (such as Claude, Codex, Copilot, or Gemini) initiate command-line processes (e.g., shells, interpreters, or network utilities) with arguments indicative of credential access, reconnaissance, or sensitive file interactions.
Detects anomalous activity where an AI coding assistant process reads sensitive local credential files (such as .env, .aws/credentials, or SSH keys) followed by an outbound network connection to a destination not associated with known package registries or AI provider APIs. This pattern is indicative of potential prompt-injection attacks targeting autonomous AI coding tools to exfiltrate developer secrets.
Detects the installation of AI agent-related packages (npm, pip, etc.) followed shortly by unauthorized access to sensitive files or credential stores on the same host. This pattern is indicative of a malicious or 'poisoned' AI agent tool performing credential theft or unauthorized exfiltration of sensitive system data.
This rule detects potential exfiltration of sensitive files, specifically 'cert.pem' and 'private.key', via HTTP POST requests to the '/api/adbk/upload' endpoint. This pattern is characteristic of the RatHat malware attempting to exfiltrate device credentials to a Command and Control (C2) server.
Detects access, reading, or modification of sensitive credential files (such as KeePass databases, VPN profiles, private SSH keys, and certificates) by a process. This behavior is often associated with pre-encryption staging for data exfiltration during ransomware attacks.
This rule monitors for suspicious credential-related activity targeting ONVIF interfaces on network devices (such as IP cameras). It detects a pattern where a successful 'global.login' RPC authentication is quickly followed (within 300 seconds) by commands or RPC methods related to credential dumping or user enumeration (e.g., OnvifUser, GetUsers). This sequence is indicative of an adversary using legitimate access to gain unauthorized information from a device.
Detects the creation, modification, or renaming of files named '.passphrase' or '.txid' within user directories. These file names are indicative of potential sensitive credential or wallet-related data storage, which may be targeted by adversaries for credential theft or unauthorized access.
Page 2 of 12