Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
Detects processes other than the authorized system processes ('security' and 'securityd') interacting with the login.keychain-db file. Adversaries often target this file to extract stored credentials from the macOS keychain.
This rule detects processes attempting to open or read files commonly associated with cryptocurrency wallets (Exodus, Electrum, MetaMask) on the endpoint. Unauthorized access to these files is a common indicator of credential theft or attempts to compromise wallet data.
Detects the Cursor IDE (Cursor.exe) or its child processes accessing sensitive SSH private key files or cloud provider authentication credentials. This behavior is indicative of a compromised IDE process, potentially leveraging malicious extensions or MCP (Model Context Protocol) servers to exfiltrate secrets from the local filesystem.
This rule detects when common Windows LOLBins (Living-off-the-Land Binaries) or scripting hosts attempt to read, create, modify, or rename sensitive credential storage files (such as login databases and cookies) associated with popular web browsers like Chrome, Edge, and Firefox. Such behavior is a common indicator of credential theft activity by information-stealing malware.
Detects instances where browser-related credential files (Login Data, Cookies, cookies.sqlite) are accessed by processes that are not the associated web browsers. This behavior is indicative of credential theft or dumping, where unauthorized processes attempt to read sensitive browser data to extract stored credentials, cookies, or session tokens.
This rule detects potential information stealing activity by identifying either known StealC payload hashes or unauthorized processes spawned by PowerShell accessing web browser credential files (e.g., Login Data, Cookies, Local State). This is often associated with ClickFix or similar delivery mechanisms where an attacker uses PowerShell to stage sensitive browser data for exfiltration.
Detects read, creation, or modification events involving common cryptocurrency wallet files (e.g., wallet.dat) or directories associated with wallet applications (Exodus, Electrum, Ledger Live) located within user application support directories. This behavior is indicative of credential access attempts where an adversary is trying to steal private keys or wallet data.
This rule detects unauthorized read, creation, modification, or renaming activity involving sensitive browser files (Login Data, Cookies, Web Data) on macOS. Adversaries often target these files to extract saved credentials, cookies for session hijacking, or browsing history.
Detects instances where processes other than common web browsers (e.g., Chrome, Edge, Firefox) access sensitive browser data files (such as login data, cookies, or history) located in standard browser profile directories. This behavior is indicative of credential dumping or unauthorized data collection from local web browser storage.
This rule detects processes attempting to access known cryptocurrency wallet data files. These files, such as 'wallet.dat' or 'wallet.json', are high-value targets for attackers seeking to exfiltrate cryptographic assets. The rule excludes common, legitimate cryptocurrency wallet applications that are expected to access these specific files.
This rule detects node.js processes that either attempt to read sensitive cloud credential or configuration files (AWS, Google Cloud, Azure) or establish network connections to a specific remote IP address (85.137.53.71) on ports 8080 or 8081. This behavior is indicative of credential theft or potential command and control (C2) activity from a compromised node environment.
Detects Python scripts or processes accessing browser 'Local State' files and subsequently invoking decryption routines like DPAPI's CryptUnprotectData or NSS's PK11SDR_Decrypt. This behavior is indicative of credential theft activity where malware, such as BusySnake Stealer, attempts to decrypt stored browser credentials for exfiltration.
Detects the LabubaRAT implant (masquerading as nvidia-sysruntime.exe) performing file system checks against Chrome, Firefox, Microsoft Edge, and Brave installation paths as part of its enumerate_browsers() host profiling routine.
Detects the use of the built-in Windows utility esentutl.exe to copy sensitive registry hives (SAM, SECURITY, or SYSTEM). This is a known technique used by adversaries to perform offline credential dumping by accessing the registry hive files.
Detects unauthorized access attempts to session files and account credentials stored locally by Discord, Telegram, and Steam applications, a behavior consistent with the CastleStealer malware.
This rule detects suspicious activity where a process initiates a network listening connection, launches a shell (sh, bash), and engages in file read or rename operations within a short 15-minute window. This behavior is indicative of a potential backdoor setup, lateral movement, or malicious script execution.
Detects unauthorized or unprivileged user-mode processes attempting to access files within Volume Shadow Copy paths. This behavior is indicative of reconnaissance or exploit techniques such as those observed in the RoguePlanet framework, where attackers enumerate snapshots to resolve stable file paths for subsequent malicious activity.
Detects processes attempting to copy or access browser cookie files, indicated by strings associated with unauthorized data collection tools or custom scripts.
Detects a node.exe process spawned by VS Code (Code.exe) performing sandbox/CI-CD evasion checks associated with the malicious @jaymara/jsononifier npm dependency, including a filesystem existence check for '/.dockerenv' or file access under a folder path referencing the @jaymara/jsononifier package prior to XOR-decoded payload execution.
Detects the use of the built-in Windows utility esentutl.exe to copy sensitive registry hives (SAM, SECURITY, or SYSTEM). This is a known technique used by adversaries to perform offline credential dumping by accessing the registry hive files.
Detects unauthorized processes attempting to access sensitive browser credential files ('Login Data', 'Local State', 'key4.db', 'logins.json') which are typically associated with stored passwords and profile data. The rule specifically excludes common web browsers (Chrome, Edge, Firefox, Brave, Opera) to reduce noise from legitimate browser operations.
Page 37 of 76