Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
56 detections
Filters
Last updated
All Time
Detection languages
29
13
10
3
1
Contributors
54
2
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
24
23
5
3
3
Products / Services
16
15
7
4
4
MITRE Techniques
16
11
8
7
6
CVEs
11
IDS Classtypes
2
1
IDS Protocols
1
1
1
Detects curl POSTing hardcoded username/password-style credentials to a /login endpoint on a known tunnel domain (ngrok, Cloudflare Quick Tunnel, or localhost.run), indicating credential submission to an attacker-exposed tunnel endpoint.
Detects fileless PowerShell execution that performs Wi-Fi credential dumping via netsh wlan key=clear, accesses browser credential stores, or reads SSO token cache (.tbres) files, consistent with ChocoShell infostealer activity.
Detects curl POSTing hardcoded username/password-style credentials to a /login endpoint on a known tunnel domain (ngrok, Cloudflare Quick Tunnel, or localhost.run), indicating credential submission to an attacker-exposed tunnel endpoint.
Detects the Abyssos HVNC_CLONE_START to GRABCOOKIES to cookie-injection chain: browser profile/cookie staging under a temp fontconfigs folder correlated with a non-browser process connecting to a local Chrome/Edge/Brave remote-debugging port (9222) used for Network.setCookie session hijacking.
Detects a decrypted Keychain dump (security dump-keychain -d) spawned from a Cursor/coding-agent process with output filtered for Linear, MCP, or OAuth-related strings, indicating targeted credential theft of MCP/Linear integration tokens.
Detects curl reusing a captured cookie jar (-b /tmp/lhr_c) against a known tunnel domain, indicating session-cookie replay to hijack an authenticated session exposed via a reverse tunnel.
Detects Abyssos RECOVERY and RECOVERY_GECKO modules used to harvest Chrome/Firefox credentials, requiring an unsigned executable freshly dropped in the Windows temp folder using the rcv/rvg naming pattern that references browser credential stores (Chrome Login Data, Firefox key4.db) alongside the module's hardcoded XOR decryption key
Detects sign-ins from the same user account occurring from two different countries within a short time window, where the implied travel velocity exceeds physically achievable speeds, indicating impossible travel or anomalous geolocation change consistent with a hijacked account or API key credential, with special attention to sudden access from China-based infrastructure.
Detects file access/modification/creation events targeting .env files or browser credential storage artifacts, combined with process command lines referencing API_KEY/TOKEN alongside environment-variable access patterns, indicative of infostealer malware harvesting developer secrets and browser-stored credentials, followed by an outbound network connection consistent with exfiltration.
Detects a decrypted Keychain dump (security dump-keychain -d) spawned from a Cursor/coding-agent process with output filtered for Linear, MCP, or OAuth-related strings, indicating targeted credential theft of MCP/Linear integration tokens.
Identifies Azure AD service principal credentials (KeyId) that have been continuously used for 90 or more days without rotation, surfacing long-lived static API keys/credentials that increase exposure risk to token jacking, credential theft, or gray-market resale of AI/API access.
Detects the macOS security CLI dumping the Claude Code OAuth credential item from Keychain (find-generic-password -w targeting 'Claude Code-credentials') by a process other than Claude Code itself, indicating credential theft targeting the coding agent's stored token.
Detects DNS resolution of Microsoft-lookalike doppelganger domains within 60 seconds of an HTTP redirect on the same host/session, consistent with CaptiveCrunch captive-portal hijacking.
Detects reuse of the same Entra ID sign-in token for the same user across two sign-ins within 60 minutes combined with impossible travel and either a new device or atypical client, excluding known corporate VPN egress and travel history.
Detects npm install/ci/postinstall or publish process activity correlated within a short time window to outbound network connections toward destinations that are not on the known-safe npm registry/CDN allowlist and are not recognized internal mirrors, indicative of malicious npm packages (Shai-Hulud/Miasma) exfiltrating tokens/credentials or beaconing to attacker infrastructure during package install or propagation.
Detects DNS queries for Storm-2945 Microsoft-impersonating doppelganger domains and traffic to actor-controlled AitM resolver/redirect infrastructure on captive-portal networks.
Detects correlated activity within a 15-minute window combining two or more browser credential-theft indicators: CDP remote-debugging launch, scheduled task with TASK_LOGON_INTERACTIVE_TOKEN, SYSTEM token impersonation, and VSS shadow copy creation.
Detects suspicious cross-process memory access or memory-dump activity targeting chrome.exe, consistent with extraction of the Security Domain Secret (SDS) master key or wrapped identity/UV private keys used to decrypt synced passkey credentials (Golden Pass-ta-key attack). Excludes known legitimate crash-dump and diagnostic tooling (WerFault, crashpad_handler, procdump, Chrome itself).
Detects a non-Chrome, unsigned process reading Chrome's Sync Data LevelDB store, where encrypted WebauthnCredentialSpecifics passkey records are persisted, consistent with the collection stage of a Pass-ta-key credential-theft chain. Excludes Chrome itself, known backup/sync clients, the Windows Search indexer, and signed security/EDR tooling.
Detects non-standard processes, particularly fileless PowerShell, accessing Windows Token Broker cache (.tbres) files, a technique associated with ChocoShell credential/token theft.
Detects suspicious cross-process memory access or memory-dump activity targeting chrome.exe, consistent with extraction of the Security Domain Secret (SDS) master key or wrapped identity/UV private keys used to decrypt synced passkey credentials (Golden Pass-ta-key attack). Excludes known legitimate crash-dump and diagnostic tooling (WerFault, crashpad_handler, procdump, Chrome itself).
Page 2 of 3