Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
24 detections
Filters
Last updated
All Time
Detection languages
11
9
2
2
Contributors
21
1
1
1
Categories
11
10
9
5
4
Platforms
10
9
7
4
2
Products / Services
14
8
2
2
2
MITRE Techniques
9
9
7
7
4
CVEs
71
71
64
58
49
24
IDS Classtypes
1
1
IDS Protocols
1
1
Detects suspicious cross-process memory access or memory-dump activity targeting chrome.exe, consistent with extraction of the Security Domain Secret (SDS) master key or wrapped identity/UV private keys used to decrypt synced passkey credentials (Golden Pass-ta-key attack). Excludes known legitimate crash-dump and diagnostic tooling (WerFault, crashpad_handler, procdump, Chrome itself).
Detects a non-Chrome, unsigned process reading Chrome's Sync Data LevelDB store, where encrypted WebauthnCredentialSpecifics passkey records are persisted, consistent with the collection stage of a Pass-ta-key credential-theft chain. Excludes Chrome itself, known backup/sync clients, the Windows Search indexer, and signed security/EDR tooling.
Detects abuse of Google Cloud Authenticator device-management API calls associated with the Pass-ta-key attack, where an attacker-controlled key is introduced or a device is de-registered without a legitimate biometric/attestation ceremony. Covers device/register with keys/genpair, device/add_uv_key, and device/forget commands observed in cloud authenticator device-management event logs. To reduce false positives, device/add_uv_key and device/forget calls only alert when they lack an associated preceding hardware attestation or biometric ceremony event, and legitimate user-initiated new-device enrollment (following a known legitimate sign-in with a prior MFA/biometric ceremony on the requesting device) and legitimate account-recovery flows are excluded.
Detects use of process-dumping utilities (procdump) or the rundll32 comsvcs.dll MiniDump technique invoked against chrome.exe, consistent with an unprivileged process reading browser process memory to extract the passkey Security Domain Secret (SDS) master key (Golden Pass-ta-key attack).
Detects deletion of the Chrome passkey_enclave_state file by a process other than chrome.exe or the Chrome updater. Legitimate deletions of this file occur during Chrome uninstall/reinstall, user-initiated 'Clear Browsing Data' or profile reset actions, Chrome profile deletion via chrome://settings, and Chrome auto-update operations - all of which are performed by chrome.exe or the Google Update process/updater tree and are excluded here. Deletions by any other process are flagged as suspicious. Analysts should further prioritize alerts where the deletion is immediately followed by unexpected passkey re-registration/re-onboarding activity, correlated separately via re-onboarding indicators.
Detects suspicious cross-process memory access or memory-dump activity targeting chrome.exe, consistent with extraction of the Security Domain Secret (SDS) master key or wrapped identity/UV private keys used to decrypt synced passkey credentials (Golden Pass-ta-key attack). Excludes known legitimate crash-dump and diagnostic tooling (WerFault, crashpad_handler, procdump, Chrome itself).
Detects a non-Chrome, unsigned process reading Chrome's Sync Data LevelDB store, where encrypted WebauthnCredentialSpecifics passkey records are persisted, consistent with the collection stage of a Pass-ta-key credential-theft chain. Excludes Chrome itself, known backup/sync clients, the Windows Search indexer, and signed security/EDR tooling.
Detects new-device passkey bootstrap via PRF exchange and encrypted passkey download correlated with an anomalous signal (no prior authentication history on the device, new geolocation/ASN, or missing user-presence confirmation on the trusted device), consistent with an attacker abusing the one-time cross-device sync bootstrap flow to sync a victim's passkeys to an attacker-controlled device.
Detects the Silver Pass-ta-key attack chain where a device or UV key registration event (device/register, keys/genpair, device/add_uv_key) on the cloud authenticator is followed within a short window by a successful login to a high-value account from a device with no prior authentication history. To reduce false positives from legitimate device enrollment-then-use, the rule additionally requires either that the registration lacked an expected attestation/biometric ceremony, or that the subsequent login originated from a geolocation/ASN inconsistent with the user's normal authentication pattern, consistent with fully automated authentication using an attacker-registered UV key without human interaction.
Detects OAuth2 token requests scoped to Google's secureidentity.action, used for passkey/security-domain-secret operations. Chrome's own sync/passkey process routinely requests this scope from the browser, so those requests (identified by a Chrome User-Agent) are excluded. Remaining matches indicate the token request did not originate from the legitimate Chrome browser process (e.g. a non-browser client, script, or tool crafting the request directly), which is anomalous and warrants investigation for possible passkey/security-domain-secret abuse or token reuse across devices.
Detects a non-browser process (unsigned, or not matching the legitimate Chrome/Edge install path and signature) invoking Windows CNG NCrypt APIs against the TPM-backed platform crypto provider, consistent with an attacker mimicking Chrome's passkey identity/UV key signing flow to forge authentication (Pass-ta-key). Excludes correctly signed Chrome and Edge processes running from their standard install locations.
Detects successful passkey/WebAuthn authentication or signing events where the User Verification (UV) flag is unset/false or no UV assertion accompanies a device-key signature, scoped to relying parties/credentials where UV is policy-required, or corroborated by a missing biometric/user-presence event or a static (unchanged) signature counter. This reduces noise from relying parties or lower-risk contexts that legitimately do not require UV on every assertion.
Detects automated or scripted access to Chrome's internal chrome://device-log/FIDO diagnostics page, or command-line evidence of 'security domain secret'/keys/wrap content, which can unintentionally expose the Security Domain Secret (SDS) master key. Scoped to headless/automation-flagged or script-launched Chrome processes to reduce noise from manual developer/support troubleshooting.
Detects deletion of the Chrome passkey_enclave_state file by a process other than chrome.exe or the Chrome updater. Legitimate deletions of this file occur during Chrome uninstall/reinstall, user-initiated 'Clear Browsing Data' or profile reset actions, Chrome profile deletion via chrome://settings, and Chrome auto-update operations - all of which are performed by chrome.exe or the Google Update process/updater tree and are excluded here. Deletions by any other process are flagged as suspicious. Analysts should further prioritize alerts where the deletion is immediately followed by unexpected passkey re-registration/re-onboarding activity, correlated separately via re-onboarding indicators.
Detects new-device passkey bootstrap via PRF exchange and encrypted passkey download correlated with an anomalous signal (no prior authentication history on the device, new geolocation/ASN, or missing user-presence confirmation on the trusted device), consistent with an attacker abusing the one-time cross-device sync bootstrap flow to sync a victim's passkeys to an attacker-controlled device.
Detects automated or scripted access to Chrome's internal chrome://device-log/FIDO diagnostics page, or command-line evidence of 'security domain secret'/keys/wrap content, which can unintentionally expose the Security Domain Secret (SDS) master key. Scoped to headless/automation-flagged or script-launched Chrome processes to reduce noise from manual developer/support troubleshooting.
Detects the Silver Pass-ta-key attack chain where a device or UV key registration event (device/register, keys/genpair, device/add_uv_key) on the cloud authenticator is followed within a short window by a successful login to a high-value account from a device with no prior authentication history. To reduce false positives from legitimate device enrollment-then-use, the rule additionally requires either that the registration lacked an expected attestation/biometric ceremony, or that the subsequent login originated from a geolocation/ASN inconsistent with the user's normal authentication pattern, consistent with fully automated authentication using an attacker-registered UV key without human interaction.
Detects likely exfiltration of encrypted synced passkey (WebauthnCredentialSpecifics) blobs to external C2 infrastructure, correlated with a prior non-browser read of Chrome's Sync Data LevelDB store, consistent with the collection-and-exfiltration stage of a Pass-ta-key credential-theft chain. Excludes traffic destined to Google's own domains.
Detects OAuth2 token requests scoped to Google's secureidentity.action, used for passkey/security-domain-secret operations. Chrome's own sync/passkey process routinely requests this scope from the browser, so those requests (identified by a Chrome User-Agent) are excluded. Remaining matches indicate the token request did not originate from the legitimate Chrome browser process (e.g. a non-browser client, script, or tool crafting the request directly), which is anomalous and warrants investigation for possible passkey/security-domain-secret abuse or token reuse across devices.
Detects a network connection to Google's passkey enclave or caBLE hybrid-transport domain (*.ua5v.com) that should be correlated with EDR process telemetry to confirm the source process is non-browser, unsigned, or otherwise anomalous rather than the legitimate Chrome browser.
Detects a non-browser process (unsigned, or not matching the legitimate Chrome/Edge install path and signature) invoking Windows CNG NCrypt APIs against the TPM-backed platform crypto provider, consistent with an attacker mimicking Chrome's passkey identity/UV key signing flow to forge authentication (Pass-ta-key). Excludes correctly signed Chrome and Edge processes running from their standard install locations.
Page 1 of 2