Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,456
11,839
5,876
5,155
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects unauthorized processes attempting to interact with the elevation_service.exe (the Chrome App-Bound Encryption service) via COM mechanisms. This activity is a known indicator of the Glove Stealer 'five-tier ABE bypass' technique, which is used to decrypt browser-stored credentials and session cookies by abusing the service's interface.
Detects unauthorized processes attempting to read LevelDB or credential storage files belonging to common Electron-based applications (Discord, Signal, Slack, Teams, Telegram). This behavior is characteristic of info-stealer malware like Yuta or Glove Stealer that target browser and application-based session tokens.
This rule monitors for large outbound network data transfers (greater than 10MB) over standard web ports (80/443) initiated by processes typically associated with office productivity applications (e.g., WinWord, Excel, Outlook) or credential dumping tools (lsass.exe). It further correlates this activity with preceding network connections to common directory service ports (LDAP/Global Catalog) on the same host, indicating potential credential collection followed by data exfiltration.
Detects a non-interactive sign-in using an existing session shortly after the user completes interactive MFA, which can indicate stolen token replay. This rule identifies scenarios where a user successfully completes an interactive multi-factor authentication (MFA) sign-in, and then, within a short time frame (1800 seconds or 30 minutes), a non-interactive sign-in occurs for the same user and session ID. This pattern is indicative of a stolen session token being replayed by an attacker, bypassing subsequent MFA prompts.
This rule detects unauthorized read access to Chromium-based browser sensitive files (Login Data, Cookies, Web Data) by processes other than known browser executables. This behavior is indicative of credential theft or session hijacking, often observed in malware such as Atlas RAT, ValleyRAT, and SilentRunLoader.
This rule detects non-browser processes attempting to read sensitive files within Chromium-based browser profiles, such as 'Login Data', 'Cookies', and 'Web Data'. Such activity is highly indicative of credential theft or session token exfiltration by malicious software targeting stored browser secrets.
Detects BQT.exe attempting to access sensitive browser credential stores or staging credential files.
Detects indicators of the IronWorm malware performing self-propagation by abusing npm Trusted Publishing (OIDC) token exchange, executing suspicious npm publish commands, and unauthorized access to ~/.npmrc configuration files. The rule monitors for network requests to npm OIDC endpoints from non-standard processes, npm publish operations originating from non-interactive shell or script environments, and file access to credential files by suspicious parent processes.
Detects suspicious credential harvesting activities, specifically identifying processes performing a sweep of multiple sensitive configuration files (e.g., AWS, Kubernetes, SSH keys, npm, git) or processes accessing /proc/self/environ to enumerate environment variables for sensitive data.
Detects a non-browser process reading browser profiles, cookies, form stores, or session files from Chrome, Edge, Brave, or Opera browsers. The rule specifically looks for file events (creation, writing, deletion) on browser-related files like 'Cookies', 'Login Data', 'Web Data', 'History', or 'Local State' within browser user data directories, where the process performing the action has a filename matching common RAT patterns like 'banana', 'client', 'update', or 'service'.
Detects unauthorized processes (excluding known web browsers and system processes) attempting to access sensitive browser credential files (e.g., Login Data, key4.db) followed by a network connection to external IP addresses. This behavior is highly indicative of credential theft and subsequent exfiltration.
This rule detects multiple suspicious registry modifications typically associated with threat actor activity. It identifies potential persistence via HKLM Run keys using QEMU-related strings, attempts to tamper with Windows Defender security settings (DisableAntiSpyware/DisableRealtimeMonitoring), and the enabling of WDigest plaintext credentials, which facilitates credential dumping.
This rule detects processes other than standard web browsers performing network connections that coincide with OAuth token acquisition activities (POST requests containing 'access_token' in the response body). This behavior is indicative of potential token theft or unauthorized programmatic access to OAuth-protected resources.
Detects instances where a user successfully authenticates from a mobile device (Android or iPhone) that exhibits a geographic mismatch (geo_country vs registered_country), and subsequently performs a sensitive credential or MFA-related action (enrollment or reset) from a different device within one hour. This pattern is indicative of a potential session hijacking or credential compromise where an attacker attempts to establish persistence by enrolling their own MFA device.
This rule detects unauthorized attempts by processes other than standard web browsers to access credential-related files, including browser login databases, Firefox key files, and known cryptocurrency wallet data files. These activities are indicative of credential harvesting or theft attempts by malicious software.
Detects rapid access to multiple sensitive developer credential files (e.g., AWS, Kubernetes, Docker, SSH keys, npm, Git, and crypto wallets) by a single process within a 5-minute window, a pattern indicative of automated credential harvesting.
This rule detects the BQT.exe (BQTLock ransomware) process attempting to access web browser credential files (Chrome, Firefox, Opera) or creating a password staging file in the Windows Temp directory. This behavior is indicative of credential theft performed by the ransomware prior to or during the encryption process.
Teampcp Shell Recon
YARA-L
Tracks shell reconnaissance parsing /var/log/auth.log for successful logins or executing env | grep AWS_.
Detects a MobaXterm credential decryption utility reading session configuration or registry data before SSH or RDP activity, indicating potential credential access for lateral movement.
Detects Python executing adconnectdump.py, which targets credentials stored by Microsoft Entra Connect. This tool is used to dump credentials from Microsoft Entra Connect (formerly Azure AD Connect) installations.
Detects instances where a Node.js process accesses or modifies browser-related credential, cookie, or configuration files. This behavior is indicative of unauthorized data collection or credential harvesting from locally stored web browser profiles.
Page 109 of 206