Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects AWS credentials or config file reads by scripting engines (Python/Node/Ruby/etc.) excluding known AWS tooling, matching the mrmustard stealer's credential-theft behavior.
Detects unauthorized file access attempts targeting sensitive data directories such as Telegram tdata, web browser credential stores (Login Data, Cookies), cryptocurrency wallet configuration folders (Exodus, Electrum), and Foxmail data files. This rule filters out legitimate access by the corresponding applications themselves to reduce noise.
Detects unauthorized file access attempts targeting sensitive data directories such as Telegram tdata, web browser credential stores (Login Data, Cookies), cryptocurrency wallet configuration folders (Exodus, Electrum), and Foxmail data files. This rule filters out legitimate access by the corresponding applications themselves to reduce noise.
Detects suspicious activities associated with browser profile hijacking. It flags the use of Robocopy to mirror browser user data directories (potentially to steal session cookies) and the subsequent launch of a web browser (Chrome/Edge) with security-disabling flags such as --no-sandbox and --disable-features=RendererCodeIntegrity, which are commonly used to bypass security features and access protected browser data.
Detects suspicious activities associated with browser profile hijacking. It flags the use of Robocopy to mirror browser user data directories (potentially to steal session cookies) and the subsequent launch of a web browser (Chrome/Edge) with security-disabling flags such as --no-sandbox and --disable-features=RendererCodeIntegrity, which are commonly used to bypass security features and access protected browser data.
Detects SSH private key file access by scripting interpreters while excluding legitimate SSH/git tooling, matching the mrmustard stealer's SSH key theft behavior.
Detects suspicious processes (PowerShell, MSHTA, WScript, CScript, or CMD) attempting to read sensitive browser or wallet files (Login Data, Cookies, Local State, etc.). This behavior is frequently associated with information stealers attempting to extract credentials and sensitive information from local endpoints.
Detects instances where a process other than msiexec.exe performs directory change operations (ReadDirectoryChangesW) within the 'C:\Config.Msi' folder. This path is often used by the Windows Installer, and unauthorized access to this directory can indicate suspicious activity related to DLL sideloading or persistence mechanisms.
Detects access to the Windows DPAPI master key storage directory located at '\Microsoft\Protect\' by processes other than standard system components (lsass.exe, svchost.exe, dllhost.exe). Accessing these files is a common technique used by adversaries to decrypt sensitive credentials stored on the system.
Detects attempts by non-browser processes to access sensitive Chromium-based browser files including Login Data, Cookies, and Web Data. This behavior is indicative of credential dumping or session cookie theft where unauthorized software attempts to extract browser-stored secrets.
Detects attempts by non-browser processes to access sensitive Chromium-based browser files including Login Data, Cookies, and Web Data. This behavior is indicative of credential dumping or session cookie theft where unauthorized software attempts to extract browser-stored secrets.
Detects unauthorized file access events targeting the Telegram Desktop AppData directory, which is a known technique for exfiltrating messenger session data and credentials. This rule filters for file access actions and is intended to exclude legitimate access by the Telegram application process itself.
Detects file access events for 'logAzure.txt', which is used by a specific implant to store RSA private keys for C2 payload decryption.
Detects the CylindricalCanine/GoldenEyeDog credential-theft pattern where the malware first kills a running browser or chat client (Chrome.exe, firefox.exe, skype.exe, 360se.exe, 360chrome.exe, QQBrowser.exe) and then, within a short window, reads/creates the associated credential/profile files (Login Data, avBackup.dat, FormData3.dat, historyUrl3.db, history3.db) on the same device.
Detects suspicious activities associated with browser profile hijacking. It flags the use of Robocopy to mirror browser user data directories (potentially to steal session cookies) and the subsequent launch of a web browser (Chrome/Edge) with security-disabling flags such as --no-sandbox and --disable-features=RendererCodeIntegrity, which are commonly used to bypass security features and access protected browser data.
Detects unauthorized file access attempts targeting sensitive data directories such as Telegram tdata, web browser credential stores (Login Data, Cookies), cryptocurrency wallet configuration folders (Exodus, Electrum), and Foxmail data files. This rule filters out legitimate access by the corresponding applications themselves to reduce noise.
Detects the access or execution of Windows Library files (.library-ms) which can be leveraged as a vector for forced NTLM authentication (CVE-2025-24054). By placing a maliciously crafted library file on a system or network share, an attacker can cause the victim's machine to automatically authenticate to an external resource, potentially exposing user credentials for NTLM relay or cracking.
Detects the access or execution of Windows Library files (.library-ms) which can be leveraged as a vector for forced NTLM authentication (CVE-2025-24054). By placing a maliciously crafted library file on a system or network share, an attacker can cause the victim's machine to automatically authenticate to an external resource, potentially exposing user credentials for NTLM relay or cracking.
Detects a single Python process sequentially accessing all three sandbox/container-detection artifacts (.dockerenv, .containerenv, /proc/1/cgroup), the environment-fingerprinting technique used by the mrmustard stealer before executing its payload.
Detects AWS credentials or config file reads by scripting engines (Python/Node/Ruby/etc.) excluding known AWS tooling, matching the mrmustard stealer's credential-theft behavior.
Detects suspicious activity associated with credential stealers where an unsigned or unrecognized process accesses MetaMask or Exodus wallet vault/seed files, performs process injection into legitimate browser/wallet binaries, or attempts to utilize DPAPI (CryptUnprotectData) or PBKDF2 for wallet credential decryption.
Page 35 of 76