Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects unauthorized file access attempts targeting sensitive data directories such as Telegram tdata, web browser credential stores (Login Data, Cookies), cryptocurrency wallet configuration folders (Exodus, Electrum), and Foxmail data files. This rule filters out legitimate access by the corresponding applications themselves to reduce noise.
Detects suspicious activities associated with browser profile hijacking. It flags the use of Robocopy to mirror browser user data directories (potentially to steal session cookies) and the subsequent launch of a web browser (Chrome/Edge) with security-disabling flags such as --no-sandbox and --disable-features=RendererCodeIntegrity, which are commonly used to bypass security features and access protected browser data.
Detects suspicious activities associated with browser profile hijacking. It flags the use of Robocopy to mirror browser user data directories (potentially to steal session cookies) and the subsequent launch of a web browser (Chrome/Edge) with security-disabling flags such as --no-sandbox and --disable-features=RendererCodeIntegrity, which are commonly used to bypass security features and access protected browser data.
Detects SSH private key file access by scripting interpreters while excluding legitimate SSH/git tooling, matching the mrmustard stealer's SSH key theft behavior.
Detects suspicious processes (PowerShell, MSHTA, WScript, CScript, or CMD) attempting to read sensitive browser or wallet files (Login Data, Cookies, Local State, etc.). This behavior is frequently associated with information stealers attempting to extract credentials and sensitive information from local endpoints.
Detects access to the Windows DPAPI master key storage directory located at '\Microsoft\Protect\' by processes other than standard system components (lsass.exe, svchost.exe, dllhost.exe). Accessing these files is a common technique used by adversaries to decrypt sensitive credentials stored on the system.
Detects attempts by non-browser processes to access sensitive Chromium-based browser files including Login Data, Cookies, and Web Data. This behavior is indicative of credential dumping or session cookie theft where unauthorized software attempts to extract browser-stored secrets.
Detects attempts by non-browser processes to access sensitive Chromium-based browser files including Login Data, Cookies, and Web Data. This behavior is indicative of credential dumping or session cookie theft where unauthorized software attempts to extract browser-stored secrets.
Detects unauthorized file access events targeting the Telegram Desktop AppData directory, which is a known technique for exfiltrating messenger session data and credentials. This rule filters for file access actions and is intended to exclude legitimate access by the Telegram application process itself.
Detects anomalous sign-in behavior where a single unique token identifier is used from multiple IP addresses, countries, or devices within a short timeframe (less than one hour). This pattern is often indicative of session token theft, where an adversary uses an exfiltrated token to authenticate from a different location or device, bypassing standard credential-based authentication.
This rule detects rundll32.exe attempting to access the memory of common web browsers (Chrome, Edge, Firefox, IE). The activity is identified by the presence of 'jangadeiro' in the command line of the rundll32 process, which is a known behavior of the Lampion banking trojan used for browser overlay credential theft.
Detects the CylindricalCanine/GoldenEyeDog credential-theft pattern where the malware first kills a running browser or chat client (Chrome.exe, firefox.exe, skype.exe, 360se.exe, 360chrome.exe, QQBrowser.exe) and then, within a short window, reads/creates the associated credential/profile files (Login Data, avBackup.dat, FormData3.dat, historyUrl3.db, history3.db) on the same device.
Detects credential dumping activity targeting the Local Security Authority Subsystem Service (LSASS) process using mimikatz.exe. This rule monitors for the execution of mimikatz.exe, direct process access (OpenProcess/ProcessAccessedLsass) to lsass.exe by mimikatz, and the spawning of lsass.exe by the mimikatz process, as observed in post-exploitation scenarios following initial backdoor access.
Detects suspicious activities associated with browser profile hijacking. It flags the use of Robocopy to mirror browser user data directories (potentially to steal session cookies) and the subsequent launch of a web browser (Chrome/Edge) with security-disabling flags such as --no-sandbox and --disable-features=RendererCodeIntegrity, which are commonly used to bypass security features and access protected browser data.
Detects the JC-46 AsyncRAT technique chain where the malware opens winlogon.exe's process token, duplicates it into an impersonation token, calls ImpersonateLoggedOnUser, enables SE_DEBUG_NAME via AdjustTokenPrivileges to reach SYSTEM context, then uses CNG (NCryptOpenStorageProvider/NCryptOpenKey/NCryptDecrypt) and BCrypt AES-GCM (BCryptOpenAlgorithmProvider) APIs to unwrap Chromium v96+ App-Bound Encryption keys.
Detects unauthorized file access attempts targeting sensitive data directories such as Telegram tdata, web browser credential stores (Login Data, Cookies), cryptocurrency wallet configuration folders (Exodus, Electrum), and Foxmail data files. This rule filters out legitimate access by the corresponding applications themselves to reduce noise.
Detects the creation of a file named 'logAzure.txt' that contains sensitive Microsoft Graph or cloud configuration credentials, such as TenantId, ClientId, ClientSecret, or UserEmail. This activity is indicative of credential staging or exfiltration by malicious actors.
Detects anomalous post-authentication activity in n8n where the authentication issuer for an account changes from historical norms. This identifies potential account takeover (ATO) scenarios where a hijacked token or cross-issuer session is used to perform lateral movement, workflow manipulation, credential access, or data exfiltration, consistent with behaviors associated with vulnerabilities like CVE-2026-59208.
Detects AWS credentials or config file reads by scripting engines (Python/Node/Ruby/etc.) excluding known AWS tooling, matching the mrmustard stealer's credential-theft behavior.
Detects suspicious activity associated with credential stealers where an unsigned or unrecognized process accesses MetaMask or Exodus wallet vault/seed files, performs process injection into legitimate browser/wallet binaries, or attempts to utilize DPAPI (CryptUnprotectData) or PBKDF2 for wallet credential decryption.
This rule monitors for suspicious activity often associated with credential or sensitive information discovery in development environments. It identifies: 1) Access to configuration files or directories related to AI-powered development tools (e.g., Cursor, Windsurf, Zed) which may store environment variables or API keys; 2) Network connections to common cloud instance metadata endpoints; and 3) Execution of command-line tools attempting to access AWS secrets or configuration management APIs (Secrets Manager, SSM).
Page 68 of 206