Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,453
11,838
5,876
5,154
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects instances where a node.exe process attempts to open sensitive browser files such as 'Login Data' or 'Cookies', which are common targets for credential theft. Additionally, it monitors for network communication (DNS requests or HTTP connections) to the domain 'stitch-production.org', which may be a command and control (C2) endpoint.
Identifies users accessing Cloudflare Turnstile or reCAPTCHA gateways immediately preceding the AiTM proxy domain resolution. This behavior is indicative of an adversary-in-the-middle (AiTM) phishing attack attempting to bypass CAPTCHA challenges.
This rule detects unauthorized or suspicious file access to sensitive configuration, credential, and identity files by 'node.exe' or 'bun.exe' processes. It flags instances where these runtime processes access multiple unique sensitive files, excluding those officially associated with the Node.js or OpenJS Foundations, which is a common indicator of credential exfiltration or reconnaissance by malicious scripts in an environment.
Detects a non-browser process creating copies of at least three Chromium credential or browsing databases in a temporary, roaming, public, or program-data directory. The logic requires the reported SessionGate, Remus, or AnimateClipper structure rather than a standalone executable name.
Detects a web session that proxies an enterprise authorisation endpoint while also handling session-cookie names associated with authenticated access. This rule identifies suspicious activity indicative of an Adversary-in-the-Middle (AiTM) attack where an attacker proxies authentication requests and steals session cookies.
Detects one web session posting username, password, and MFA or one-time-code form fields through the same intermediary host. This behavior is indicative of an Adversary-in-the-Middle (AiTM) attack, where an attacker intercepts and relays authentication requests, including multi-factor authentication (MFA) codes, to gain unauthorized access.
Detects a successful multifactor authentication followed within minutes by another successful sign-in for the same account from a different IP address and user agent. This pattern can indicate an adversary has bypassed MFA, potentially through techniques like AiTM phishing, and is attempting to use the compromised session.
Detects the modified ScreenConnect calling DPAPI encryption routines natively to hide the C2 configuration variables.
Detects instances of Chrome, Edge, or Brave browsers being launched with specific, suspicious command-line arguments (e.g., --no-first-run, --disable-gpu, about:blank) from parent processes that are not standard browser or update launchers. This behavior is indicative of Vidar Stealer attempting to force a browser instance to generate or expose the master encryption key, facilitating the theft of browser-stored credentials.
Detects instances of Chrome, Edge, or Brave browsers being launched with specific command-line arguments ('--no-first-run', '--disable-gpu', 'about:blank') by a non-browser parent process. This technique is commonly used by Vidar Stealer to create a child browser process that is vulnerable to memory injection or diagnostic manipulation, allowing the attacker to bypass Chrome Application-Bound Encryption (ABE) and extract master keys.
Detects unauthorized file read operations targeting local cryptocurrency wallet directories and browser extension storage (MetaMask, Phantom, etc.) by suspicious processes (e.g., node.exe, chost.exe) or processes executing from temporary or user-writable application directories, commonly associated with infostealer malware.
Detects unauthorized access to cloud provider credential files (AWS, GCP, Azure) by potentially suspicious processes. It specifically monitors processes such as node.exe, npm, python, bash, or binaries running from temporary directories (/tmp, %TEMP%) while excluding legitimate CLI tools.
Detects unauthorized access to browser credential storage files (e.g., Login Data, Cookies, Local State) by suspicious non-browser processes such as node.exe, powershell.exe, or wscript.exe. This activity is often associated with infostealer malware, particularly in supply chain attacks where malicious scripts attempt to dump browser-saved credentials or session cookies.
Detects unauthorized access to Chromium-based and Firefox browser credential stores (Login Data, Cookies, logins.json) by processes executing from temporary directories (e.g., AppData, Temp). This behavior is characteristic of infostealer malware, such as CASTLESTEALER, often delivered via process injection or hollowed processes.
Detects a file containing a cluster of strings commonly associated with Chromium credential stealing malware. The strings include references to Chromium profile database files like 'Login Data', 'Network\Cookies', 'History', and 'Web Data', as well as 'Local State' (often used for encryption keys) and the Windows API function 'CryptUnprotectData', which is used to decrypt DPAPI-protected data.
This rule detects potential OAuth token abuse by correlating credential consent grants with subsequent unusual cloud access patterns from different geographic locations. It looks for activities like adding a service principal, adding OAuth2 permission grants, or consenting to an application, followed by access to specific cloud applications (Salesforce, Drift, Slack, Microsoft 365, Workday) from an IP address that does not match the IP address from which the consent was granted. The rule aggregates these events and triggers if there are at least 4 related events within a 6-hour window.
Detects suspicious access to web browser credential files (Login Data, Cookies) by processes other than the browsers themselves. This could indicate an attempt to steal stored credentials.
Detects unauthorized access, creation, or modification of sensitive credential and token files (e.g., OAuth tokens, AWS credentials, gcloud tokens) in common user directories like AppData or .config by processes other than established browsers or legitimate cloud CLI tools. This behavior is indicative of credential theft or SaaS pivot attacks.
Detects activity associated with the macOS.Gaslight credential stealer, specifically focusing on Python processes accessing the login.keychain-db, browser credential stores, creating a 'collected_data.zip' archive, and executing security or reconnaissance commands. This rule identifies file events (creation, modification, read, copy) related to keychain and archive staging, as well as process events involving the 'security' command for password extraction and 'ps' or 'system_profiler' for system reconnaissance, all initiated by Python.
Detects the use of 'credwiz.exe' with the 'B' argument, which indicates a credentials backup operation. This activity could be indicative of an adversary attempting to dump credentials from a compromised system.
This rule detects attempts by non-browser processes to access sensitive web browser credential files such as 'Login Data', 'key4.db', and 'logins.json'. This activity is highly indicative of credential dumping or information theft, as legitimate browser processes are excluded from the detection.
Page 123 of 206