Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects unauthorized processes accessing browser credential databases (e.g., 'Login Data') used by Google Chrome, Brave, and Microsoft Edge. This activity is a common indicator of credential theft by malicious software.
The following analytic detects non-Chrome processes accessing the Chrome "Local State" file, which contains critical settings and information. It leverages Windows Security Event logs, specifically event code 4663, to identify this behavior.
This activity is significant because threat actors can exploit this file to extract the encrypted master key used for decrypting saved passwords in Chrome.
If confirmed malicious, this could lead to unauthorized access to sensitive information, posing a severe security risk.
Monitoring this anomaly helps identify potential threats and safeguard browser-stored data.
This activity is significant because threat actors can exploit this file to extract the encrypted master key used for decrypting saved passwords in Chrome.
If confirmed malicious, this could lead to unauthorized access to sensitive information, posing a severe security risk.
Monitoring this anomaly helps identify potential threats and safeguard browser-stored data.
Detects access attempts to credential files, private keys, and secrets (id_rsa, credentials.json, .pem, etc.).
Detects file access events targeting the Mozilla Thunderbird profile directory on Windows systems, which may indicate unauthorized collection or theft of local email data, archives, and account configuration files.
Detects file system access to the ProtonVPN local configuration directory. This directory may contain sensitive data, such as cached credentials or session information, which could be targeted by unauthorized actors to facilitate credential theft or session hijacking.
The following analytic detects a non-Chrome process accessing files in the Chrome user default folder. It leverages Windows Security Event logs, specifically event code 4663, to identify unauthorized access attempts. This activity is significant because the Chrome default folder contains sensitive user data such as login credentials, browsing history, and cookies. If confirmed malicious, this behavior could indicate an attempt to exfiltrate sensitive information, often associated with RATs, trojans, and advanced persistent threats like FIN7. Such access could lead to data theft and further compromise of the affected system.
Detects anomalous behavior by pythonw.exe where it interacts with screen locker assets or loads specific DLLs from non-standard locations, indicative of a PhishLocker-style fake lock screen being deployed to capture user credentials.
Detects processes attempting to interact with multiple browser binaries (chrome.exe or msedge.exe) across different standard application directories within a short time window. This behavior often indicates an adversary or malicious script probing for specific installed browsers to facilitate credential harvesting, configuration dumping, or session hijacking.
Detects access to the FileZilla RecentServers.xml file, which contains historical server connection information. Attackers frequently target this file to extract stored FTP credentials, hostnames, and usernames for lateral movement or data exfiltration.
The following analytic detects non-Chrome processes attempting to access the Chrome extensions file.
It leverages Windows Security Event logs, specifically event code 4663, to identify this behavior.
This activity is significant because adversaries may exploit this file to extract sensitive information from the Chrome browser, posing a security risk.
If confirmed malicious, this could lead to unauthorized access to stored credentials and other sensitive data, potentially compromising the security of the affected system and broader network.
It leverages Windows Security Event logs, specifically event code 4663, to identify this behavior.
This activity is significant because adversaries may exploit this file to extract sensitive information from the Chrome browser, posing a security risk.
If confirmed malicious, this could lead to unauthorized access to stored credentials and other sensitive data, potentially compromising the security of the affected system and broader network.
The following analytic identifies non-Chrome processes accessing the Chrome user data file "login data."
This file is an SQLite database containing sensitive information, including saved passwords.
The detection leverages Windows Security Event logs, specifically event code 4663, to monitor access attempts.
This activity is significant as it may indicate attempts by threat actors to extract and decrypt stored passwords, posing a risk to user credentials.
If confirmed malicious, attackers could gain unauthorized access to sensitive accounts and escalate their privileges within the environment.
This file is an SQLite database containing sensitive information, including saved passwords.
The detection leverages Windows Security Event logs, specifically event code 4663, to monitor access attempts.
This activity is significant as it may indicate attempts by threat actors to extract and decrypt stored passwords, posing a risk to user credentials.
If confirmed malicious, attackers could gain unauthorized access to sensitive accounts and escalate their privileges within the environment.
This analytic detects uncommon processes reading or requesting read access to sensitive files from cloud providers on Windows endpoints.
It monitors Windows Security Event 4663 for ReadData (AccessMask 0x1) operations against sensitive files from cloud providers such as Azure.
Access by any process outside the known toolchain may indicate credential theft or cloud identity reconnaissance activity, including infostealer behavior such as one observed in Vidar Stealer variants.
This detection currently only supports Azure sensitive files, but will be extended to support other cloud providers in the future.
It monitors Windows Security Event 4663 for ReadData (AccessMask 0x1) operations against sensitive files from cloud providers such as Azure.
Access by any process outside the known toolchain may indicate credential theft or cloud identity reconnaissance activity, including infostealer behavior such as one observed in Vidar Stealer variants.
This detection currently only supports Azure sensitive files, but will be extended to support other cloud providers in the future.
Detects instances where AI coding assistants (e.g., Cursor, Claude, Copilot) are observed interacting with specific configuration or sensitive files and subsequently initiating suspicious shell commands. The rule correlates file read activity (containing keywords like 'skill', 'preflight', '.ssh', or '.aws') followed closely by execution of potentially malicious commands like 'whoami /priv', credential decoding, or registry exploration, indicating potential abuse of the assistant's context.
Detects bulk SharePoint/M365 file access or download either from a known UNC6671 exfiltration IP, or via a scripting-library user agent that is new for the user and exceeds a volume threshold within a short session window.
This rule detects unauthorized or unexpected processes accessing sensitive browser data files, specifically 'Login Data' (password databases) and 'Cookies' files, located in standard macOS browser paths for Google Chrome and Firefox. By excluding legitimate browser and system update processes, the rule identifies potential credential dumping or session hijacking attempts.
This rule detects instances where a process that is not a recognized web browser attempts to access sensitive files associated with browser credential stores, such as Login Data, Cookies, and web browser state files. Such activity is commonly associated with infostealer malware, which attempts to exfiltrate saved passwords, session cookies, and autofill information.
This rule detects anomalous, high-volume file access activity within SharePoint by monitoring the 'FileAccessed' operation. It calculates a 14-day rolling baseline for each user and triggers an alert when the hourly 'FileAccessed' count significantly exceeds this baseline, specifically when no corresponding 'FileDownloaded' events are present. This behavior aims to detect stream-based data exfiltration techniques that bypass standard download-based DLP controls.
Detects instances where AI coding assistants (e.g., Cursor, Claude, Copilot) are observed interacting with specific configuration or sensitive files and subsequently initiating suspicious shell commands. The rule correlates file read activity (containing keywords like 'skill', 'preflight', '.ssh', or '.aws') followed closely by execution of potentially malicious commands like 'whoami /priv', credential decoding, or registry exploration, indicating potential abuse of the assistant's context.
Detects anomalous spikes in per-user M365 (SharePoint and Exchange) activity volume by comparing current 15-minute intervals against a 30-day rolling baseline (mean + 3 standard deviations). This behavior may indicate mass data staging or exfiltration activities common in precursor phases of extortion or data theft.
Detects potential credential theft attempts targeting macOS Keychain. It identifies the use of the 'security' utility with commands like 'dump-keychain' or 'find-generic-password' and monitors for unauthorized processes accessing files within the 'Library/Keychains' directory.
This rule detects potential credential or sensitive file theft from VS Code extensions or configuration folders, followed closely by network exfiltration to the Telegram API. It specifically monitors file access to common paths (.ssh/id_rsa, .aws/credentials, .netrc, Local Storage, etc.) by VS Code processes, correlated with non-Telegram processes establishing network connections to api.telegram.org within a 10-minute window.
Page 32 of 76