Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
208 detections
Filters
Last updated
All Time
Detection languages
101
42
20
14
12
Contributors
66
35
26
14
14
Categories
153
105
57
39
26
Platforms
146
106
58
12
7
Products / Services
47
27
26
23
21
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
3
3
1
1
1
IDS Classtypes
1
1
IDS Protocols
1
1
This rule detects attempts to copy SSL private key files over SMB. It specifically looks for network traffic on port 445 (SMB) containing the strings ".key" and "private" (case-insensitive) in the data being sent to the server. This activity could indicate an attacker attempting to exfiltrate sensitive cryptographic material.
Detects a Node.js or npm process attempting to read sensitive credential files such as SSH keys, npm tokens, K8s configurations, cloud credentials, or Vault material. This rule is tuned for the Red Hat Cloud Services supply chain attack by monitoring for Node.js/npm processes executing in the context of the affected packages or preinstall hooks.
Detects the execution of the GitHub CLI command used to print the active authentication token, which is abused by the Shai-Hulud worm to steal developer credentials.
Detects access or creation of files within Google Drive that have credential-related names, indicating potential credential harvesting attempts or unauthorized access to sensitive data. The rule specifically looks for file events such as 'view', 'edit', 'create', or 'access_url' on files whose titles contain keywords commonly associated with credentials (e.g., password, secret, key, token, etc.).
GitHub CLI Token Extraction
Cortex XDR
Detects the execution of `gh auth token` which is used by the Shai-Hulud malware to steal the active GitHub Personal Access Token (PAT). This rule specifically looks for the `gh.exe` or `gh` process executing with command-line arguments containing both "auth" and "token".
Detects Node.js or Bun processes accessing sensitive developer configuration directories such as .ssh and .npmrc, indicating potential credential harvesting. This rule specifically looks for file access or open events initiated by 'node.exe', 'node', 'bun.exe', or 'bun' processes targeting paths containing '.ssh' or '.npmrc', or files named '.npmrc'.
This rule detects suspicious activity related to OpenSSL or certificate manipulation by identifying processes that execute commands containing 'openssl' or 'certificate' keywords. It aggregates these activities by computer and account within one-hour bins and flags if three or more such activities occur, which could indicate credential access attempts or system misconfiguration.
Detects Node.js or Bun processes accessing sensitive developer configuration directories such as .ssh and .npmrc, indicating potential credential harvesting. This rule specifically looks for file access or open events initiated by 'node.exe', 'node', 'bun.exe', or 'bun' processes targeting paths containing '.ssh' or '.npmrc', or files named '.npmrc'.
Node.js Accessing Developer Secrets
Cortex XDR
Detects Node.js processes rapidly reading multiple sensitive developer configuration or credential files (e.g., .env, AWS credentials, SSH keys) within a short timeframe. This behavior is indicative of infostealer activity, often observed with malicious npm packages.
Detects the execution of the 'gh auth token' command. This behavior was observed being used by the TeamPCP malicious npm package (hijacked @bitwarden/cli) via a shell collector script to harvest active GitHub CLI authentication tokens from developer endpoints.
Detects command-line activity associated with the execution of the Checkmarx compromise payload (mcpAddon.js), which systematically attempts to dump tokens from gh, gcloud, az, and azd CLI tools.
Detects the specific PowerShell command structures used by the TeamPCP Checkmarx payload (mcpAddon.js) to extract and process Azure access tokens using the Az.Accounts module.
Detects the specific PowerShell command structures used by the TeamPCP Checkmarx payload (mcpAddon.js) to extract and process Azure access tokens using the Az.Accounts module.
Show when private keys are being exported from the device, or when new certificates are installed
Detects broad filesystem searches using native OS commands ('dir' on Windows, 'find' on Linux/macOS) for files containing sensitive developer information like private keys, mnemonic phrases, and configuration files. This TTP is used by modules 5 and 6 of the StegaBin toolkit.
This rule detects suspicious code search queries within Azure DevOps audit logs that may indicate an adversary is attempting to find sensitive information such as passwords, API keys, tokens, or private keys. It specifically looks for keywords like 'password', 'secret', 'token', 'apikey', 'api_key', 'connectionstring', 'connstring', 'credential', 'private key', and 'BEGIN RSA PRIVATE KEY' in code search queries.
Detects execution of suspicious tools or commands that may indicate credential or secret discovery. Generic detection for processes attempting to enumerate credentials, secrets, or sensitive information across files, repositories, or environments.
Detects when a known OpenClaw AI agent process executes commands associated with credential access or system discovery. This behavior can indicate a "0-click" prompt injection attack, where the agent is manipulated into executing malicious commands received through external data streams like emails or IM messages.
PFX File Creation
Sigma
Detects the creation of PFX (Personal Information Exchange) files. PFX files contain private keys and certificates, making them high-value targets for attackers. Adversaries may create these files to exfiltrate digital certificates for impersonation, establish persistent access via certificate-based authentication, or bypass security controls. Analysts should investigate the process responsible for creating the PFX file, its parent process chain, and any unusual file locations outside of standard certificate stores or development environments.
The following analytic detects the deletion of SSH keys or configuration files on a Linux machine. It leverages filesystem event logs to identify when files within "/etc/ssh/*" or "~/.ssh/*" are deleted. This activity is significant because attackers may delete or modify SSH keys to evade security measures or as part of a destructive payload, similar to the AcidRain malware. If confirmed malicious, this behavior could lead to impaired security features, hindered forensic investigations, or further unauthorized access, necessitating immediate investigation to identify the responsible process and user.
The following analytic detects suspicious attempts to find SSH private keys, which may indicate an attacker's effort to compromise secure access to systems. SSH private keys are essential for secure authentication, and unauthorized access to these keys can enable attackers to gain unauthorized access to servers and other critical infrastructure. By monitoring for unusual or unauthorized searches for SSH private keys, this analytic helps identify potential threats to network security, allowing security teams to quickly respond and safeguard against unauthorized access and potential breaches.
Page 8 of 10