Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
82 detections
Filters
Last updated
All Time
Detection languages
30
15
14
13
4
Contributors
23
11
7
7
6
Categories
45
18
16
15
14
Platforms
69
15
4
2
1
Products / Services
25
15
11
8
8
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
1
IDS Classtypes
4
IDS Protocols
3
1
Infostealer-as-a-service targeting browser credentials and crypto wallets
Infostealer-as-a-service targeting browser credentials and crypto wallets
Infostealer-as-a-service targeting browser credentials and crypto wallets
Infostealer-as-a-service targeting browser credentials and crypto wallets
Infostealer-as-a-service targeting browser credentials and crypto wallets
Infostealer-as-a-service targeting browser credentials and crypto wallets
Infostealer-as-a-service targeting browser credentials and crypto wallets
Lumma NetworkIOC
YARA
Infostealer-as-a-service targeting browser credentials and crypto wallets
Detects network communication patterns indicative of RedLine Stealer activity by looking for specific keywords in the RemoteUrl field during inbound or outbound connections.
This rule detects the execution of processes with command lines containing indicators associated with 'Phantom Stealer' malware, such as 'phantom stealer', 'stealer.dll', 'phantom.exe', or 'phtantom'. This could indicate an attempt to load or execute the stealer.
Detects Vidar Stealer attempting to access virtual memory of Chrome, Edge, or Brave processes to locate the v20_master_key, which is used to bypass Application-Bound Encryption. This rule also identifies suspicious browser process creations with specific command-line arguments that might indicate stealer activity.
Detects unauthorized processes attempting to read, modify, or create files within common browser credential locations (Chrome, Firefox, Edge, and Windows Credential Manager). Legitimate browser processes and their known signers are excluded, focusing on suspicious secondary processes or tools frequently utilized by infostealers like Lumma and RedLine to dump credentials.
Detects known malicious file hashes associated with malware families (VIDAR, LUMMAC.V2, RADTHIEF, ATOMIC) distributed by the threat actor UNC5142.
Detects StealC's characteristic self-deletion pattern where cmd.exe executes a timeout delay followed by a forced quiet file deletion (/f /q) of the malware binary. This occurs as StealC's final operation after data exfiltration when the self_delete flag is set in the C2 configuration.
Detects connections to domains associated with observed ACR Stealer command-and-control infrastructure.
Detects connections to domains associated with observed ACR Stealer command-and-control infrastructure.
Detects the ClickFix paste-and-run initial-access primitive used by KongTuke and other groups. This involves `explorer.exe` spawning PowerShell with defense-evasion arguments (`-NoProfile`, `-ExecutionPolicy Bypass`, `-WindowStyle Hidden`) and a downloader chain targeting cloud file-sharing services. The combination of `explorer.exe` parent (user typing into Run dialog), hidden execution flags, `Invoke-WebRequest`, and `Expand-Archive` in one command line is the defining fingerprint of the technique.
This rule set detects various stages of activity related to the 'OpenClaw' malware family and associated campaigns. It includes detection for OpenClaw process execution, exposure of a specific administrative port, execution of shell commands via curl (ClawHavoc delivery), outbound webhook exfiltration, and infostealer access to OpenClaw configuration files.
This rule detects indicators associated with the RenEngine campaign, which involves the deployment of HijackLoader, Lumma Stealer, and ACR Stealer. Detection is based on specific MD5 hashes of known malicious files, filenames used in the campaign, and command and control (C2) domains identified as part of the infrastructure.
Detects the MSHTA utility (mshta.exe) executing a remote script which then spawns a .NET registration utility (RegAsm.exe or RegSvcs.exe). This specific execution chain is a high-confidence indicator of malware loaders like XWorm and Lumma Stealer, often delivered via ClickFix social engineering lures.
This rule detects artifacts associated with the RenEngine, HijackLoader, and Lumma campaigns. It identifies these threats through a combination of specific MD5 hashes, high-signal domain markers (both distribution and C2 domains), and unique filenames. The rule triggers if a file's MD5 hash matches one of the known malicious hashes, or if it contains at least one specific filename in conjunction with at least one domain marker, or if it contains at least two distinct domain markers (either distribution or C2).
Page 2 of 4