Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,456
11,839
5,876
5,155
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects modifications to the 'SSLKEYLOGFILE' environment variable in the Windows Registry. This variable is often used by applications like web browsers to log SSL/TLS session keys to a file, which can then be used to decrypt encrypted network traffic. Malicious actors might enable this to capture sensitive data.
This rule monitors for unauthorized access to the Google Chrome 'Login Data' database file by processes other than standard browser executables. It also detects the creation of known file artifacts associated with credential-stealing malware or RATs (e.g., 'chrome_logins_dump.txt' or 'gather.tar.gz'), which are indicative of credential harvesting activities.
Detects unauthorized processes accessing the Google Chrome 'Login Data' SQLite database file or the creation of a 'chrome_logins_dump.txt' file, which are indicators of potential credential theft activity often seen in RATs or information stealers.
Detects unauthorized processes accessing the Google Chrome 'Login Data' SQLite database file or the creation of a 'chrome_logins_dump.txt' file, which are indicators of potential credential theft activity often seen in RATs or information stealers.
This rule detects unauthorized attempts to extract credentials from the Veeam Backup and Replication PostgreSQL database. It identifies malicious activity involving the use of PowerShell to interact with the database, including direct psql.exe command line execution, PowerShell scripts referencing sensitive database keywords, WMI-spawned PowerShell processes, and network connections to the PostgreSQL service port (5432).
Detects unauthorized access to the Veeam Backup PostgreSQL database to extract credentials, a technique observed in Akira ransomware campaigns. The rule monitors for suspicious execution of psql.exe or PowerShell scripts designed to query the 'VeeamBackup' database for credentials, which are subsequently decrypted using DPAPI.
Detects the use of the PostgreSQL client utility (psql.exe) to directly query the VeeamBackup database for credential information. This behavior is indicative of unauthorized attempts to extract encrypted backup credentials, which may be subsequently decrypted using DPAPI.
Detects the modification of the registry to disable RDP Restricted Admin mode. This allows attackers to access plaintext credentials from the remote machine. This TTP is associated with the threat actor UAT-8837.
Identifies successful device code authentications originating from non-trusted named locations. This can indicate an attempt to bypass multi-factor authentication or compromise an account through device code phishing.
Correlates the successful DNS resolution of a legit domain to a malicious IP, followed by an HTTP POST submitting stolen credentials. Specifically looks for POST requests to 'login.microsoftonline.com' where the remote IP address is not a known Microsoft IP range (13.x.x.x or 20.x.x.x).
Detects unauthorized access to web browser sensitive files, including credential stores, cookies, and local state files, by processes other than standard browsers or their update mechanisms. This rule also flags access to specific staging directories or archive files associated with known malicious activity.
Detects the registration of a new authentication method (phone, authenticator app, passkey, or security key) in Azure Active Directory after a session exhibits unusual location or token behavior, indicated by a high or medium risk level, anonymous proxy usage, or unfamiliar features.
Detects a process rapidly accessing multiple target credential stores (Login Data, Cookies, Web Data, places.sqlite) within a short time frame (1 minute). This behavior is indicative of credential stealer malware like Vidar attempting to exfiltrate sensitive browser data.
Detects unauthorized access to sensitive browser files, such as login databases, cookies, and encryption keys (e.g., key4.db, Login Data), from Chromium and Firefox-based browsers by processes other than the browsers themselves. The rule requires multiple distinct credential files to be accessed to minimize false positives.
Detects unauthorized processes attempting to read KeePass database files (.kdbx) or VPN configuration files (.ovpn, .vpn) from user directories. This behavior is consistent with the GIFTEDCROOK stealer and UAC-0226 activity, aimed at harvesting credentials from password managers and VPN clients.
Detects potential credential theft activity where a user or compromised process executes shell commands to inspect environment variables, AWS credential files, or project configuration files (e.g., .env) for sensitive secrets such as API keys and access tokens.
Detects unauthorized access to browser credential and sensitive configuration files (e.g., Login Data, cookies, key4.db) by processes that are not legitimate web browsers. The rule specifically accounts for known GIFTEDCROOK browser-stealing behavior by excluding legitimate browser subprocesses like utility, crashpad, or gpu processes.
Detects unauthorized access to KeePass database (.kdbx) and VPN configuration (.ovpn) files by processes originating from the C:\ProgramData\ directory. This behavior aligns with the activity of the GIFTEDCROOK information stealer observed during UAC-0226 campaigns, where malicious payloads are executed from staging folders within ProgramData.
This rule detects when a non-standard or unexpected process attempts to access multiple sensitive credential files simultaneously. Specifically, it monitors for file access to Chrome login data, Firefox login and cookie databases, or KeePass database files (.kdbx). By flagging processes that access two or more distinct types of these files, the rule identifies potential credential dumping or harvesting attempts by malicious software not associated with legitimate browser or password manager activity.
Detects device registration or join activity by an account shortly after a risky sign-in or policy-lure interaction, indicating potential compromise of the account.
Detects a PDF, SVG, HTML, or presentation attachment containing a QR code or extracted URL that leads into an enterprise authentication workflow. This rule is designed to identify phishing attempts where adversaries embed QR codes or malicious URLs within common document types to direct users to fake enterprise login pages for credential harvesting.
Page 117 of 206