Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects the execution of PowerShell scripts or commands related to the 'Invoke-ClientIdSpoofEnum' tool, which is used for OAuth client ID spoofing. This technique allows attackers to bypass security controls by enumerating valid client IDs within Microsoft Entra environments, potentially leading to unauthorized token requests.
Detects processes attempting to read sensitive browser storage files, specifically 'Login Data' (passwords) and 'Cookies', located within common browser paths for Chrome, Firefox, and Safari on macOS or similar environments using Application Support/Library folders.
This rule detects suspicious sign-in patterns indicative of an EvilTokens-style Microsoft Device Code OAuth phishing attack. It identifies successful device code flow sign-ins where Multi-Factor Authentication (MFA) was not applied or satisfied, suggesting an adversary has bypassed MFA using a stolen device code. The rule aggregates these suspicious sign-ins by user, listing associated applications, IP addresses, and locations for analyst review.
Detects HTTP POST requests directed at known Kratos Phishing-as-a-Service (PhaaS) URI paths, specifically 'PTT', 'SOft', or 'mini.php'. These paths are commonly associated with credential exfiltration activities.
Detects execution of security utility commands on macOS intended to unlock a login keychain by providing a password via command line arguments. This behavior is indicative of an attempt to programmatically access stored credentials, which may be a precursor to credential theft.
Detects instances where runas.exe is used to launch PowerShell and monitors subsequent child processes for suspicious commands or activity, such as credential dumping tools, encoded commands, or access to sensitive browser data locations, which may indicate credential theft or unauthorized lateral movement.
Detects file access events targeting sensitive browser files, specifically 'passwords.json' and 'cookies.json', located within the standard Chrome/browser application data directories. These files often contain stored credentials and session cookies, and unauthorized access is a common precursor to credential theft.
Detects unauthorized processes attempting to access sensitive credential database files (Login Data, key4.db, logins.json) used by Chromium-based browsers or Mozilla Firefox. This behavior is indicative of credential theft attempts, where malicious actors seek to extract saved passwords and cookies from the browser's local storage.
Detects unauthorized access attempts to session files and account credentials stored locally by Discord, Telegram, and Steam applications, a behavior consistent with the CastleStealer malware.
This rule detects the dumping of sensitive Windows Registry hives (SECURITY, SAM, and SYSTEM) using tools like reg.exe, esentutl.exe, regedit.exe, or by leveraging Volume Shadow Copy services (vssadmin/diskshadow). These hives are targeted by attackers for credential access, specifically to extract LSA secrets, local account hashes, and bootkeys required to decrypt credentials offline. The rule calculates a risk score based on the combination of hives dumped, the method used, the output destination, and the parent process context, flagging 'complete' dumps (SAM+SECURITY+SYSTEM) as critical.
Detects successful execution of the 'List Credentials' action on an Azure Container Registry. This action returns the administrative credentials (username and password) for the registry, which may indicate unauthorized credential access or preparation for exfiltration or lateral movement.
This rule detects potential password spraying or brute-force activity by monitoring Azure Sign-in logs for a high volume of failed authentication attempts (error code 50126) originating from a single IP address across multiple distinct user accounts.
Detects processes other than the authorized system processes ('security' and 'securityd') interacting with the login.keychain-db file. Adversaries often target this file to extract stored credentials from the macOS keychain.
This rule detects processes attempting to open or read files commonly associated with cryptocurrency wallets (Exodus, Electrum, MetaMask) on the endpoint. Unauthorized access to these files is a common indicator of credential theft or attempts to compromise wallet data.
Detects potential discovery of sensitive information (secrets) within container images by monitoring for the usage of 'dive' targeting private Azure Container Registry images or the use of 'docker inspect' to extract 'Config.Env' combined with 'grep' for the term 'secret'. This activity is often associated with reconnaissance for credential harvesting in containerized environments.
Detects the Cursor IDE (Cursor.exe) or its child processes accessing sensitive SSH private key files or cloud provider authentication credentials. This behavior is indicative of a compromised IDE process, potentially leveraging malicious extensions or MCP (Model Context Protocol) servers to exfiltrate secrets from the local filesystem.
This rule detects when common Windows LOLBins (Living-off-the-Land Binaries) or scripting hosts attempt to read, create, modify, or rename sensitive credential storage files (such as login databases and cookies) associated with popular web browsers like Chrome, Edge, and Firefox. Such behavior is a common indicator of credential theft activity by information-stealing malware.
This rule detects the dumping of sensitive Windows Registry hives (SECURITY, SAM, and SYSTEM) using tools like reg.exe, esentutl.exe, regedit.exe, or by leveraging Volume Shadow Copy services (vssadmin/diskshadow). These hives are targeted by attackers for credential access, specifically to extract LSA secrets, local account hashes, and bootkeys required to decrypt credentials offline. The rule calculates a risk score based on the combination of hives dumped, the method used, the output destination, and the parent process context, flagging 'complete' dumps (SAM+SECURITY+SYSTEM) as critical.
Detects instances where browser-related credential files (Login Data, Cookies, cookies.sqlite) are accessed by processes that are not the associated web browsers. This behavior is indicative of credential theft or dumping, where unauthorized processes attempt to read sensitive browser data to extract stored credentials, cookies, or session tokens.
Detects the execution chain associated with the CrySome RAT, which terminates common web browsers (Chrome, Edge, Brave), drops a malicious DLL ('abe_decrypt.dll') into a temporary directory, and subsequently restarts the browser to facilitate credential theft.
This rule detects potential information stealing activity by identifying either known StealC payload hashes or unauthorized processes spawned by PowerShell accessing web browser credential files (e.g., Login Data, Cookies, Local State). This is often associated with ClickFix or similar delivery mechanisms where an attacker uses PowerShell to stage sensitive browser data for exfiltration.
Page 70 of 206