Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
This rule detects malicious activity associated with the GIFTEDCROOK (UAC-0226) threat actor. It identifies the use of PowerShell or cmd.exe to execute staged files from specific ProgramData paths (WC3, wt1), monitors for common NT API-based reflective injection patterns (such as NtAllocateVirtualMemory and NtWriteVirtualMemory) originating from PowerShell, tracks the creation of known staging artifacts in ProgramData, and identifies the execution of known malicious process image hashes.
This rule detects processes other than standard browsers (Chrome, Edge, Firefox, Opera) or authorized password managers (KeePass) accessing sensitive files such as browser credential stores, cookies, local state configuration files, KeePass databases (.kdbx), or VPN configuration files (.ovpn). The rule identifies suspicious activity by monitoring for access patterns that indicate potential credential theft or exfiltration.
Detects instances where non-browser processes (that are not signed by major browser vendors) attempt to access common browser credential files such as 'Login Data' or 'logins.json'. This behavior is characteristic of credential dumping or exfiltration attempts by malicious software trying to steal stored browser passwords.
Detects potential financial data exfiltration by monitoring for bulk downloads of files with financial keywords from SaaS/Office365 platforms, and identifies unauthorized processes attempting to access sensitive financial application data files (.qbw, .qbb, etc.) on local systems.
This rule detects Python or Node.js processes aggressively accessing directories associated with cryptocurrency wallet browser extensions like MetaMask, Phantom, and Binance Chain. This activity is indicative of information stealer malware attempting to exfiltrate sensitive wallet data.
Identifies the Python script explicitly reading developer secrets including AWS credentials, SSH private keys, and Kubernetes configuration files.
Detects the opening of suspected APT28 (Fancy Bear) spearphishing lure documents by Microsoft Office or Outlook. The rule monitors for file access, creation, or renaming events where the filename matches known lure patterns associated with APT28 activities, such as naming conventions containing 'BULLETEN', 'OperInformativ', 'Courses', 'Consultation', 'Weapons', or 'Smuggling' in Word or Outlook processes.
Detects attempts to access or copy the Active Directory domain database (NTDS.dit) by monitoring for direct file access to the file or the execution of ntdsutil.exe with arguments intended to create an Install From Media (IFM) set, which is a known technique for exfiltrating the NTDS.dit file for offline password cracking.
Detects instances where processes other than legitimate browser components attempt to access, read, or copy the browser 'Login Data' file. This file stores credentials used by Google Chrome and Microsoft Edge, and unauthorized access is a common technique used by credential-stealing malware.
Detects instances where processes other than legitimate browser components attempt to access, read, or copy the browser 'Login Data' file. This file stores credentials used by Google Chrome and Microsoft Edge, and unauthorized access is a common technique used by credential-stealing malware.
This rule detects when the Internet Information Services (IIS) worker process (w3wp.exe) accesses sensitive files such as 'web.config', 'applicationHost.config', or 'win.ini'. Unauthorized access to these files by the IIS process can be an indicator of a web shell or other malicious post-exploitation activity attempting to steal credentials, application secrets, or system configuration information.
This rule detects various methods used to extract credentials protected by the Windows Data Protection API (DPAPI). It covers multiple vectors, including Mimikatz DPAPI module usage, unauthorized loading of the dpapi.dll library, suspicious access to browser or WiFi credential stores, and cross-process memory access to the LSASS process to extract DPAPI master keys.
Detects anomalous behavior associated with msiexec.exe that aligns with activity patterns of infostealer malwares like Lumma Stealer and Amadey Bot. This includes cross-process injection from unsigned processes, spawning of msiexec.exe by LOLBins or script interpreters, suspicious outbound network connectivity, and unauthorized access to browser credential storage files.
Detects unauthorized processes attempting to read, modify, or create files within common browser credential locations (Chrome, Firefox, Edge, and Windows Credential Manager). Legitimate browser processes and their known signers are excluded, focusing on suspicious secondary processes or tools frequently utilized by infostealers like Lumma and RedLine to dump credentials.
Detects instances where non-browser processes access sensitive browser-related files (Login Data, Cookies, or Local State) located within AppData directories. This behavior is highly indicative of credential and session token theft, often associated with AiTM or post-compromise information harvesting activities.
Detects unauthorized or non-standard processes attempting to create, modify, or access sensitive cloud configuration and credential files, such as AWS credentials, Azure CLI token caches, or GCP application default credentials. This behavior is indicative of potential credential theft or unauthorized access to cloud environment tokens.
This rule detects unauthorized or suspicious processes attempting to access sensitive local browser extension data or known password manager vault files (e.g., .kdbx, vault.json, data.json). This behavior is characteristic of infostealer malware or credential-harvesting activities attempting to extract stored secrets.
This rule looks for programs with AI-themed names (e.g., chatgpt, copilot, claude) attempting to access browser credential stores, specifically targeting login data and cookies. This activity is a common step for attackers aiming to hijack user accounts. Alerts generated by this rule should prompt an investigation into the legitimacy of the initiating process. Users should be queried about recent software installations or clicked links, and security teams should be involved if the legitimacy remains unclear.
Detects unauthorized processes (those not identified as standard web browsers) accessing browser profile directories (Local Storage or IndexedDB) associated with major AI platforms such as OpenAI, ChatGPT, Anthropic, and Copilot. This behavior is indicative of credential theft or session token exfiltration from local browser storage.
Detects Python or a Cython module opening Chromium Login Data and Local State files outside browser execution. This activity is indicative of credential theft, specifically targeting web browser stored credentials.
This rule detects potential credential harvesting activity associated with the Hannibal Stealer. It looks for non-standard processes (processes other than the browsers themselves) that access sensitive browser credential stores (like 'Login Data', 'cookies.sqlite', or 'key4.db') and correlate these file access events with the loading of 'bcrypt.dll' or 'CefSharp.BrowsersSubprocess.dll', which are often used for decryption or browser automation/sub-processes during credential theft.
Page 52 of 76