Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
252 detections
Filters
Last updated
All Time
Detection languages
109
48
29
20
15
Contributors
70
34
30
21
11
Categories
156
65
58
54
31
Platforms
129
107
62
33
16
Products / Services
39
36
27
19
18
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
5
4
2
1
1
IDS Classtypes
4
3
1
1
IDS Protocols
8
Detects unauthorized reading of the GitHub CLI hosts.yml file by processes other than standard development tools (gh, gh.exe, code). This activity could indicate an attempt to steal authenticated GitHub sessions, as the hosts.yml file contains sensitive GitHub authentication tokens.
Detects searching of bash history files for credentials
Detects attempts by non-browser processes to access sensitive Chromium-based browser data files such as Login Data, Cookies, History, Web Data, and Local State. This rule focuses on file creation events and excludes legitimate browser processes from the principal. The UDM rule retains principal and target context for correlation.
Detects access to .env files that may contain plaintext credentials
Detects download of password wordlists or hash dumps for offline cracking
Detects enumeration of git credential helpers via 'git config --global credential.helper'. This command is used by adversaries, such as Miasma, to determine how credentials are stored (e.g., wincred, osxkeychain, store) before attempting extraction.
This rule watches for Node or similar runtimes scanning cloud secret stores after installing a dependency. Stolen secrets can lead to full cloud account takeover. Validate the package against your software bill of materials. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects attempts to access sensitive credential-related files (e.g., configuration files, credential files, .env files, or files containing 'secret') via HTTP requests. This pattern is often associated with web shell activity where an attacker tries to exfiltrate sensitive information from a compromised web server.
Detects download of password wordlists or hash dumps for offline cracking
Detects post-install execution of the TeamPCP-compromised Microsoft durabletask package
(v1.4.1–1.4.3, May 2026). The worm drops rope.pyz/managed.pyz, marks infection via
~/.cache/.sys-update-check, persists as pgsql-monitor.service, and then propagates via AWS SSM
and kubectl exec.
(v1.4.1–1.4.3, May 2026). The worm drops rope.pyz/managed.pyz, marks infection via
~/.cache/.sys-update-check, persists as pgsql-monitor.service, and then propagates via AWS SSM
and kubectl exec.
Identifies Node.js processes downloading the Bun runtime from GitHub Releases. This behavior was observed in the vpmdhaj npm supply chain attack, where Gen-2 stagers silently downloaded Bun to execute bundled credential harvesting payloads without an immediate C2 payload drop.
Node.js Accessing Developer Secrets
Cortex XDR
Detects Node.js processes rapidly reading multiple sensitive developer configuration or credential files (e.g., .env, AWS credentials, SSH keys) within a short timeframe. This behavior is indicative of infostealer activity, often observed with malicious npm packages.
This suite of rules detects various activities associated with the Mini Shai-Hulud npm worm, including the execution of its payload via bun, network connections to its exfiltration domain, attempts by Node.js or Bun processes to access AWS IMDS for credential theft, access to local HashiCorp Vault instances, identification of known malicious script file hashes, and the installation of its specific malicious GitHub dependency.
Okta Sensitive OAuth Activity Detection
Cortex XDR
This rule detects sensitive OAuth activities within Okta, specifically focusing on OAuth client secret access, token revocation requests, and implicit flow requests. These activities can indicate potential compromise of OAuth clients, attempts to invalidate legitimate tokens, or the use of less secure OAuth flows that could be exploited.
Detects the execution of the 'gh auth token' command. This behavior was observed being used by the TeamPCP malicious npm package (hijacked @bitwarden/cli) via a shell collector script to harvest active GitHub CLI authentication tokens from developer endpoints.
Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.
Identifies when an admission controller is executed in GCP Kubernetes.
A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.
The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.
An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.
For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.
An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.
A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.
The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.
An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.
For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.
An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.
Identifies when an admission controller is executed in Azure Kubernetes.
A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.
The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.
An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.
For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod.
An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.
An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.
A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.
The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.
An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.
For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod.
An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.
An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.
Detects when a configuration change is made to an applications AppID URI.
Detects when a user has potentially entered their password into the
username field, which will cause the password to be retained in log files.
username field, which will cause the password to be retained in log files.
This detection rule identifies activities related to the TeamPCP Trivy supply chain compromise (CVE-2026-33634). It looks for specific indicators such as the presence of 'tpcp.tar.gz' in command lines, connections to the exfiltration domain 'scan.aquasecurtiy.org', access to '/proc/[pid]/mem' via command line, or the execution of 'sysmon.py' or 'systemctl' in suspicious contexts. A match indicates a strong reason for investigation, particularly in CI runner or developer environments, to confirm compromise and review follow-on activities.
Page 9 of 12