Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects instances where processes other than common Chromium-based web browsers attempt to access sensitive files within the browser's User Data directory, such as Login Data, Cookies, or Web Data. This behavior is often indicative of credential theft or session hijacking attempts by unauthorized software or adversaries.
Detects a process accessing browser credential-related files (Login Data, Cookies) across three or more distinct browser profiles within a 5-minute window, followed by the creation of a ZIP archive by the same process within 10 minutes. This behavior is indicative of credential theft activities where browser profiles are harvested and bundled for exfiltration, consistent with techniques used by infostealers like Dolphin X.
Detects the use of the netsh.exe utility with the 'wlan show profile' command and the 'key=clear' argument, which displays saved Wi-Fi network passwords in plaintext. This technique is often used by adversaries to perform credential harvesting on compromised systems.
Detects file access/read of the in-cluster Kubernetes service account token path or a user's kubeconfig file by a non-standard binary (e.g. scripting interpreter, shell, or network utility) rather than known Kubernetes/orchestration tooling. Narrowed to reduce false positives from legitimate kubectl, helm, kubelet, and container runtime processes that routinely read these credentials.
Detects unauthorized processes attempting to access sensitive browser files containing credentials (e.g., 'Login Data', 'logins.json') and cookies (e.g., 'store.json.mozlz4', 'Browser_Cookies.json'). This behavior is commonly associated with credential harvesting malware such as TOKYOCORE, which seeks to steal stored browser secrets before they can be encrypted or for immediate use in session hijacking.
Detects an untrusted process accessing sensitive browser credential and cookie files across multiple browser families and profiles in a short period, followed immediately by the creation of a ZIP archive. This pattern is consistent with the behavior of credential-stealing malware like Dolphin X, which aggregates stolen browser data into an archive for exfiltration.
Detects instances where a process other than the legitimate Discord client or its updater accesses the Local Storage/leveldb directory. This path contains cached authentication tokens and session data, making it a frequent target for credential theft malware such as SectopRAT in the FakeAgent campaign.
Detects scripted use of the macOS 'security find-generic-password' command targeting the Chrome Keychain item from a shell or unsigned temp-directory parent process, consistent with BlueNoroff's post-ClickFix Keychain master-key theft technique.
Detects unauthorized processes accessing Discord's local storage (LevelDB) or extracted Discord_Tokens.json files, a technique commonly used by malware like TOKYOCORE to hijack user authentication sessions.
Detects the creation of an app-specific password named 'ZimbraWeb' using the CreateAppSpecificPasswordRequest SOAP command in Zimbra logs. This technique is used to maintain persistent access to mailboxes while bypassing multi-factor authentication (MFA).
Detects the creation of overlay windows on top of sensitive financial or cryptocurrency applications and the granting of the SYSTEM_ALERT_WINDOW (draw-over-other-apps) permission to third-party applications. This behavior is highly characteristic of Android banking trojans attempting to capture credentials or PII via phishing overlays.
Detects anomalous SOAP requests to 'GetScratchCodesRequest' within the 'zimbraSync' or 'zimbraAccount' namespaces in Zimbra logs. This activity is indicative of credential harvesting attempts, specifically the exfiltration of 2FA recovery scratch codes, often associated with the ZimReaper/Ulej payload used by threat actors.
Detects processes accessing files within a user's ~/.ssh directory, excluding standard files like known_hosts and .pub files. This pattern is characteristic of malware attempting to exfiltrate SSH private keys, similar to the behavior observed in the mrmustard stealer.
Detects HTTP POST requests to the Microsoft login endpoint for OAuth2 tokens using the client_credentials grant type, where the request body contains evidence of hardcoded client_secret parameters and specific scopes. This behavior often indicates an application or script with embedded, potentially leaked or insecurely stored, credentials being used to authenticate against Microsoft cloud services.
Detects an unsigned or unrecognized process performing read or modification operations on multiple types of credential stores (SSH keys, cloud CLI configurations, and environment variable files) within a short time frame. This behavior is indicative of credential harvesting or unauthorized looting of secrets from a developer workstation, similar to techniques used by stealer malware.
Detects SSH private key file access by scripting interpreters while excluding legitimate SSH/git tooling, matching the mrmustard stealer's SSH key theft behavior.
Detects the creation of a file named 'logAzure.txt' that contains sensitive Microsoft Graph or cloud configuration credentials, such as TenantId, ClientId, ClientSecret, or UserEmail. This activity is indicative of credential staging or exfiltration by malicious actors.
Detects AWS credentials or config file reads by scripting engines (Python/Node/Ruby/etc.) excluding known AWS tooling, matching the mrmustard stealer's credential-theft behavior.
Detects the creation of a file named 'logAzure.txt' that contains sensitive Microsoft Graph or cloud configuration credentials, such as TenantId, ClientId, ClientSecret, or UserEmail. This activity is indicative of credential staging or exfiltration by malicious actors.
Detects regsvr32 loading chromelevator.ocx/mscom.ocx followed by the ChromEggscalator credential-extraction command sequence.
Detects unauthorized file access attempts targeting sensitive data directories such as Telegram tdata, web browser credential stores (Login Data, Cookies), cryptocurrency wallet configuration folders (Exodus, Electrum), and Foxmail data files. This rule filters out legitimate access by the corresponding applications themselves to reduce noise.
Page 67 of 206