Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
1
Platforms
1
Products / Services
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
This rule detects Vidar Stealer activity through two primary methods: a hash-based detection for a known Vidar 2.1 sample and a behavioral detection for non-standard parent processes spawning Chrome with specific command-line arguments. The behavioral detection targets Vidar's technique of using hash-resolved API calls (CreateNamedPipeA and WaitForSingleObject) to orchestrate APC injection into a suspended Chrome process for credential theft.
