Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,453
11,838
5,876
5,154
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects processes containing sensitive credential-related keywords (cookies, creds, password, token) in their command lines followed by a network connection to known suspicious remote IP addresses within a 60-minute window, suggesting potential credential exfiltration.
Detects command line activity indicative of an attempt to access or extract browser-related files such as 'Cookies' or 'Local State', which are commonly associated with session theft or credential harvesting from major web browsers like Chrome, Firefox, Edge, and Safari.
Detects process executions containing sensitive keywords related to trust, certificates, and multi-factor authentication (e.g., 'mfa', '2fa', 'otp') that are not initiated by standard trusted system processes (services.exe, wininit.exe, smss.exe). This pattern is often indicative of credential manipulation, certificate harvesting, or tampering with authentication mechanisms.
Detects the execution of 'filemanager.exe', a standalone credential stealer associated with the DeepLoad malware. This executable is designed to harvest browser passwords and is typically found running from user-specific application data directories such as AppData\Local, AppData\Roaming, or Temp.
This rule detects anomalous access to cloud services, specifically Salesforce, Drift, Salesloft, HubSpot, and Marketo, that may indicate OAuth token abuse. It identifies scenarios where a high volume of actions (8 or more) occur within a short timeframe (3 hours or less) from a single IP address but with multiple unique user agents (2 or more). The detection is further refined by looking for actions related to 'Add delegated permission grant' or 'Create service principal', which are indicative of an attacker attempting to establish persistence or escalate privileges after gaining access through a compromised OAuth token.
Browser extension wallet discovery
Cortex XDR
This rule detects command-line activity that searches for sensitive information within browser extension storage, specifically targeting data related to cryptocurrency wallets, password managers, or authenticator applications. It looks for commands executed by common interpreters like cmd, PowerShell, or Python that include keywords associated with extensions and sensitive data like 'wallet', 'metamask', 'password', 'authenticator', '2fa', or 'crypto'. The rule is designed to provide causality and actor information for investigation.
This rule detects attempts by non-browser processes to access sensitive Chromium-based browser files such as 'Login Data', 'Cookies', 'History', 'Web Data', and 'Local State'. These files often contain credentials, browsing history, and other sensitive user data. The rule specifically filters for file access events where the accessing process's command line does not match known browser executables (chrome.exe, msedge.exe, brave.exe, opera.exe, vivaldi.exe), indicating potential credential theft or data exfiltration by malicious software.
This rule identifies a suspicious sequence of events: a successful device code authentication immediately followed (within one hour) by a device registration event (PRT upgrade) for the same user. This pattern is indicative of a device code phishing attack where an attacker tricks a user into authenticating a device code, then registers their own device to gain persistent access.
Detects successful sign-ins utilizing the device code flow, which is frequently abused in Adversary-in-the-Middle (AiTM) phishing attacks. This rule specifically looks for successful authentication events where the 'AuthenticationProtocol' is 'deviceCode'.
This rule detects a suspicious sequence of events: first, a modification to the 'ExtensionInstallForcelist' registry key, followed within one hour by access to browser credential stores (specifically 'Login Data' or 'Cookies' files). This combination suggests an attacker might be attempting to force the installation of a malicious browser extension to steal credentials.
This rule detects the creation of Okta API tokens with broad administrative scopes (okta.users.manage, okta.factors.manage, or okta.apps.manage) by the same user multiple times within a one-hour window. This behavior can indicate an attempt to establish persistent access or bypass multi-factor authentication.
Detects network events where a device communicates with the 'urlzzz.php' endpoint, specifically when this communication is correlated with file events involving 'Login Data' or 'Cookies'. This indicates potential exfiltration of browser credentials or session information by the UnregStealer malware.
This rule detects command-line activity indicative of encryption key extraction or dumping. It looks for specific keywords like 'dumpkey', 'exportkey', 'savekey', 'keystore', and 'privkey' in the command line of processes such as 'servertool.exe', 'encrypt.exe', 'powershell.exe', and 'cmd.exe'. This activity is often associated with ransomware or other malicious software attempting to exfiltrate cryptographic keys.
Detects Pass-the-Ticket attacks using stolen Kerberos tickets
Identifies zenity being used to prompt for passwords on Linux, indicating credential theft. This technique might be used by adversaries to trick users into providing their credentials.
Detects Python scripts leveraging secret-tool or DBus on Linux to dump GNOME keyring passwords (UNK_DeadDrop). The rule specifically looks for the 'secret-tool' process being initiated by 'python' or 'python3'.
Detects execution of custom PowerShell phishing tools (first.ps1, main1.ps1) that present fake Windows update screens to steal local credentials. This rule specifically looks for PowerShell processes where the command line contains 'CredPhish' and either 'main1.ps1' or 'first.ps1'.
Detects a banking trojan (Banana RAT) attempting to intercept or replace PIX QR payment data from the clipboard, browser, or screen content. The rule looks for processes with names indicative of the RAT (banana, client, update, service) and command-line arguments related to PIX, QR codes, or clipboard manipulation.
Detects the execution of 'moladb_hash_crack.py', a script known to be used by the MuddyWater APT group for credential operations, specifically hash cracking. This rule identifies process command lines containing the script's filename.
Detects scripts (Python/Node/VBS) directly accessing Chrome or OS-level DPAPI structures (Login Data, Cookies) to extract user credentials.
Detects a compromised account performing heavy Graph API searches for HR personnel to socially engineer IT/Helpdesk. Specifically, it looks for search queries containing terms like 'HR', 'Human Resources', or 'Payroll Manager'.
Page 122 of 206