Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
56 detections
Filters
Last updated
All Time
Detection languages
29
13
10
3
1
Contributors
54
2
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
24
23
5
3
3
Products / Services
16
15
7
4
4
MITRE Techniques
16
11
8
7
6
CVEs
11
IDS Classtypes
2
1
IDS Protocols
1
1
1
Detects an address whose sign-ins are mostly failures across many accounts in a short window, with scripted clients and Storm-0940 campaign addresses flagged, which is how the password spray in Microsoft's ARTEX reporting looked. It does not cover the ConnectWise application sign-ins (service principal events) or a spray spread over many addresses. The query ran without errors in a live tenant.
Detects one identity reading secrets from several Azure Key Vaults in a day beyond its own 14 day baseline, which matches the bulk secret reads Microsoft reported after the ConnectWise application compromise. It needs the CloudKeyVaultEvents table, does not flag an identity that already reads many vaults every day and cannot show whether the reads were legitimate. The query ran without errors in a live tenant.
Detects a non-browser process directly querying the Chrome/Brave/Edge SQLite Login Data store with the exact origin_url/username_value SELECT statements used by the botking RAT to harvest saved credentials.
Detects abuse of the macOS `security` CLI to unlock the login keychain and suppress interactive prompts, or to delete/recreate the 'Chrome Safe Storage' keychain entry with an attacker-chosen password, matching AmnesiaStealer's keychain and cookie-decryption technique.
Detects local validation of a phished password via dscl -authonly immediately followed by sudo -S -v in a short time window, matching AmnesiaStealer's technique for confirming captured credentials are valid before reuse.
Correlates BTR_CLI arbitrary-write invocations (Action 3) targeting System32\drivers with a resulting file write of a known-malicious hash (e.g., mimidrv.sys) or an unsigned/non-Microsoft-signed binary — detecting the kernel write primitive being used to plant a malicious driver into a protected directory.
Detects cleartext storage of a phished password to a hidden dotfile (~/.pwd) or staging directory by a non-standard process, matching AmnesiaStealer's practice of persisting captured credentials to disk for reuse throughout its collection chain.
Detects browser cookie theft via a cloned Chrome profile directory, CDP-based cookie export, and/or SQLite re-encryption of the cookie database using an attacker-known Safe Storage password, as used by AmnesiaStealer's streaming module.
Detects a concentrated sweep of multiple browser credential/cookie artifacts (Local State, Login Data, Cookies, History) by a single non-browser process (OptiDrive.exe) within a one-minute window — the ACRStealer credential-theft stage.
Detects the malicious 'PDF Viewer' extension (bridged via the com.microsoft.runedge native-messaging helper) requesting both cookie-access and clipboard-access permissions together — the specific combination Jewelbug uses for session-token theft and cryptocurrency address swapping.
Detects a spoofed 'Installer wants to make changes' password prompt dispatched from an unsigned or ad-hoc-signed process, used by AmnesiaStealer to phish the victim's macOS login/keychain password.
Detects browser-side storage artifacts (JWRCID, JwrExecutedInstructions, JwrCvvForm) persisted by the JWR phishing kit in a victim's browser session/local storage.
Detects rapid enumeration of browser extension storage (Local Extension Settings, IndexedDB) across multiple profiles by a non-browser process, matching AmnesiaStealer's generic cryptocurrency wallet-harvesting technique.
Detects CoolClient's data-collection module: co-occurring keylogging hook installation, clipboard access, and Chromium credential-store file access from an unsigned/non-OS-vendor process.
Detects SilentDataCollector host-based surveillance: recurring screenshot capture, keylogging, WhatsApp Web automation, or known stealer binary execution.
Detects sideload installation of the malicious 'PDF Viewer' browser extension used by Jewelbug, identified by manifest content requesting cookies, debugger, native-messaging, and all-site scripting permissions together from a non-Web-Store install path.
Detects the JWR phishing kit's JwrControlInstruction mechanism relaying operator commands to the victim browser across branded login, OTP/2FA capture, and card-retry page flows.
Detects the macOS security CLI dumping the Claude Code OAuth credential item from Keychain (find-generic-password -w targeting 'Claude Code-credentials') by a process other than Claude Code itself, indicating credential theft targeting the coding agent's stored token.
Detects an unsigned/unexpected PAM module written into the su/sudo authentication stack, correlated with non-package-manager modification of /etc/pam.d/ configuration and subsequent su/sudo activity — the technique Jewelbug's Linux tooling uses to steal credentials.
Detects the exact watering-hole script fetch (fonts.chrorne[.]com /dist/js/*.chunk.js) injected into shared government webmail installations, which opens a WebSocket back to Jewelbug C2 and exfiltrates session cookies and usernames.
Detects curl reusing a captured cookie jar (-b /tmp/lhr_c) against a known tunnel domain, indicating session-cookie replay to hijack an authenticated session exposed via a reverse tunnel.
Page 1 of 3