Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
82 detections
Filters
Last updated
All Time
Detection languages
30
15
14
13
4
Contributors
23
11
7
7
6
Categories
45
18
16
15
14
Platforms
69
15
4
2
1
Products / Services
25
15
11
8
8
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
1
IDS Classtypes
4
IDS Protocols
3
1
Detects unauthorized processes attempting to read or create sensitive browser credential files ('Login Data', 'Web Data', 'Cookies', 'logins.json', 'key4.db'). This activity is commonly associated with information-stealing malware (such as Lumma, StealC, Vidar, RedLine, and Amadey) that targets browser databases to extract stored secrets, often bypassing standard browser process access.
This rule correlates endpoint security alerts for popular information-stealer malware (Lumma, StealC, Vidar, RedLine, Acreed, Atomic Stealer) with subsequent successful cloud identity authentication events from the same user account. The correlation window is set to 72 hours following an endpoint infostealer detection, which suggests potential account takeover or unauthorized access facilitated by credentials stolen from a compromised endpoint.
Detects unauthorized processes attempting to read or create sensitive browser credential files ('Login Data', 'Web Data', 'Cookies', 'logins.json', 'key4.db'). This activity is commonly associated with information-stealing malware (such as Lumma, StealC, Vidar, RedLine, and Amadey) that targets browser databases to extract stored secrets, often bypassing standard browser process access.
Detects unauthorized processes attempting to read or create sensitive browser credential files ('Login Data', 'Web Data', 'Cookies', 'logins.json', 'key4.db'). This activity is commonly associated with information-stealing malware (such as Lumma, StealC, Vidar, RedLine, and Amadey) that targets browser databases to extract stored secrets, often bypassing standard browser process access.
This rule detects network traffic associated with Lumma Stealer information-stealing malware, specifically identifying HTTP POST requests that utilize the 'TeslaBrowser/5.5' user agent. This pattern is indicative of the malware exfiltrating stolen data to its Command and Control (C2) server.
This rule detects network traffic patterns indicative of the Lumma Stealer 'ClickFix' phishing campaign. It identifies outbound requests to suspicious domains ending in .cyou utilizing specific user agents (WinHttp or Microsoft BITS), which are characteristic of malicious PowerShell scripts attempting to retrieve secondary payloads.
This rule detects network traffic patterns associated with the Lumma Stealer malware performing endpoint fingerprinting. It monitors for GET requests to the URI path '/api/set_agent' which contains a 32-character hexadecimal string, characteristic of the malware's C2 communication.
Detects instances where a process not associated with standard web browsers accesses, copies, or modifies sensitive browser files such as cookies, local storage, or session tokens. This behavior is highly indicative of information-stealer malware (e.g., Vidar, Lumma, RedLine) attempting to exfiltrate session data for account hijacking.
Detects unauthorized, non-browser processes accessing sensitive Chromium-based browser credential files (e.g., 'Local State', 'Login Data', 'Cookies') followed by suspicious outbound network connections. This pattern is characteristic of credential-stealing malware (infostealers) like Amatera, Lumma, and Remus.
Detects the creation or execution of executable files from within %APPDATA%\Local\Temp subdirectories starting with '100000', a path pattern frequently associated with the distribution and staging of infostealer malware such as RedLine and Lumma.
Detects suspicious access to browser credential stores (Google Chrome, Microsoft Edge, Mozilla Firefox, Brave) by non-browser processes within a short time frame (2 hours) after a FortiClient VPN logon event. This activity is consistent with information stealer malware, such as LummaC2, Phantom Stealer, Aurora Stealer, Luca Stealer, and Formbook, often observed in post-compromise phases of campaigns like FortiBleed.
Infostealer-as-a-service targeting browser credentials and crypto wallets
Lumma C2Beacon
YARA
Infostealer-as-a-service targeting browser credentials and crypto wallets
Detects connections to domains associated with observed ACR Stealer command-and-control infrastructure.
Detects unauthorized processes attempting to read, modify, or create files within common browser credential locations (Chrome, Firefox, Edge, and Windows Credential Manager). Legitimate browser processes and their known signers are excluded, focusing on suspicious secondary processes or tools frequently utilized by infostealers like Lumma and RedLine to dump credentials.
This rule detects the execution of processes with command lines containing indicators associated with 'Phantom Stealer' malware, such as 'phantom stealer', 'stealer.dll', 'phantom.exe', or 'phtantom'. This could indicate an attempt to load or execute the stealer.
This rule detects suspicious process injection activity where an untrusted process attempts to inject code into common trusted Windows processes (svchost.exe, explorer.exe, notepad.exe, rundll32.exe, dllhost.exe, taskhost.exe, taskhostw.exe) using a combination of VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread API calls. This behavior is often associated with malware, such as StealC, attempting to evade detection and maintain persistence.
Detects Vidar Stealer scanning the memory of a forked browser process for the Chromium KeyRing 32-byte pattern using NtReadVirtualMemory and NtQueryVirtualMemory to locate the v20_master_key across MEM_COMMIT and MEM_PRIVATE regions.
Detects Vidar Stealer scanning the memory of a forked browser process for the Chromium KeyRing 32-byte pattern using NtReadVirtualMemory and NtQueryVirtualMemory to locate the v20_master_key across MEM_COMMIT and MEM_PRIVATE regions. This behavior is indicative of an information stealer attempting to exfiltrate sensitive browser data.
Detects network communication patterns indicative of RedLine Stealer activity by looking for specific keywords in the RemoteUrl field during inbound or outbound connections.
Lumma C2Beacon
YARA
Infostealer-as-a-service targeting browser credentials and crypto wallets
Page 1 of 4