Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
This rule detects the execution of processes named 'MiniBrowse' or access attempts to common web browser credential storage files (Google Chrome 'Login Data', Microsoft Edge 'Login Data', and Mozilla Firefox 'logins.json' or 'key4.db'). These patterns are characteristic of browser credential stealing malware or unauthorized data collection tools.
This rule detects a multi-stage attack pattern involving the execution of PowerShell via explorer.exe, followed by subsequent sub-process activity that attempts to access sensitive browser-stored credentials (Login Data or Cookies) or specific cryptocurrency wallet data, combined with a concurrent network connection attempt, indicative of credential exfiltration via a command-and-control (C2) beacon.
Detects processes attempting to access specific files commonly associated with sandbox or virtual machine environments. This is a common evasion technique used by malware to detect analysis environments and terminate execution if detected.
Detects unauthorized processes attempting to access Firefox credential storage files (key4.db, logins.json) or loading the NSS cryptographic library (nss3.dll) commonly used by Firefox for decryption, which is indicative of credential harvesting.
This rule detects processes accessing sensitive browser credential files ('passwords.json' or 'cookies.json') located in common browser profile output directories. Accessing these files is a common technique used by malware and adversaries to steal stored credentials from web browsers.
This rule detects potential large-scale exfiltration or staging of sensitive documents to common cloud storage locations (Dropbox, Google Drive, OneDrive) or removable media. The rule specifically triggers when a high count (more than 20) of files labeled as sensitive are accessed or transferred by a single user within a session, specifically outside of standard business hours (before 7 AM or after 8 PM).
Detects potential exfiltration activity involving PowerShell scripts interacting with a specific remote IP address, using System.Net.WebClient to upload file contents, and referencing a common local staging file (C:\ProgramData\log.txt).
Detects credential harvesting behavior by non-browser processes attempting to access browser credential storage (Login Data/Local State files) and identifies execution of the masquerading binary 'FortiEndpoint_Patch.exe' and the creation of the 'log.txt' artifact in C:\ProgramData used by the EKZ Stealer.
This rule detects potential credential harvesting and sensitive data collection activities on macOS by monitoring for access to keychain databases, browser data files (cookies, logins), and shell history files. It looks for both direct file access and the use of the 'security' utility to dump keychain information.
Detects various indicators of credential dumping associated with Mimikatz and manual extraction of the Active Directory database (NTDS.dit). This includes execution of Mimikatz, use of specific modules like lsadump::dcsync and sekurlsa::logonpasswords, direct access to the LSASS process, and usage of ntdsutil or vssadmin to create shadow copies for NTDS.dit file access.
Detects the download of JPEG image files to suspicious system directories (e.g., C:\Windows\, C:\ProgramData\) followed by subsequent file read operations by non-image viewer processes, which is indicative of steganographic payload extraction used in campaigns such as Operation DragonReturn/DcRAT.
Detects instances where a process opens ntdll.dll directly from the filesystem as a file object. This behavior is indicative of an EDR unhooking technique where an adversary reads a clean, original version of ntdll.dll from disk to overwrite EDR-injected hook bytes in memory, thereby bypassing user-mode monitoring.
Detects unauthorized processes attempting to access Discord's local LevelDB storage files, which are commonly targeted by info-stealing malware to extract sensitive session tokens and user data.
Detects unauthorized processes attempting to access sensitive browser data files (Login Data, Cookies, Web Data) that are typically used by web browsers to store credentials and session information. The rule filters out known legitimate browser processes, flagging potential credential theft or session hijacking activity.
Detects potentially malicious activity involving MySQL processes, specifically focusing on the creation of files within the /var/lib/mysql-files/ directory, use of SQL 'INTO OUTFILE' for file output, or the use of 'LOAD_FILE()' to read sensitive system files like /etc/hostname or /proc/1/mountinfo, often indicative of SQL injection exploitation or unauthorized data access.
Detects instances where a shell interpreter (bash or sh) accesses sensitive cloud and environment configuration files, specifically when initiated by parent processes associated with IDE-integrated development tools or AI assistants (claude, cursor, copilot-cli). This behavior suggests potential unauthorized access to credentials or environment variables.
Detects a process creating SQLite-style database files with random hex-like names within a randomly named subfolder of the Windows %TEMP% directory. This behavior, when correlated with file system access to specific cryptocurrency wallet directories (Electrum, Exodus, Ethereum, Coinomi), is consistent with Vidar information stealer staging activity.
Detects activity associated with the 'MiniBrowse.exe' process, which exhibits behaviors characteristic of unauthorized browser credential and cookie harvesting. This includes targeting browser 'Login Data' files, accessing cookies, attempting to interact with legitimate browser processes (chrome.exe, msedge.exe) via cross-process operations, and writing logs to 'edgeLog.txt'.
Detects instances where a process that is not a known web browser (specifically excluding chrome.exe and msedge.exe) attempts to access sensitive browser files such as Login Data, Cookies, or Local State. This behavior is indicative of unauthorized attempts to steal stored web credentials, commonly associated with infostealer malware or browser credential theft tools.
Detects node.exe accessing sensitive SSH configuration and key files (id_rsa, id_ed25519, id_ecdsa, known_hosts, authorized_keys) within the user's .ssh directory. This behavior is associated with the Miasma and MYRA infostealers identified in the Polymarket Trap npm supply chain attack campaign, which exfiltrate developer credentials.
This rule detects suspicious activity related to accessing or dumping the NTDS.dit file, which contains Active Directory credential information. It looks for process creation events involving tools commonly used for NTDS.dit extraction (e.g., ntdsutil, secretsdump), file access events on NTDS.dit paths, and privilege use (SeBackupPrivilege, SeRestorePrivilege, SeDebugPrivilege) often associated with credential dumping.
Page 38 of 76