Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
955 detections
Filters
Last updated
All Time
Detection languages
486
121
65
63
57
Contributors
328
210
131
82
29
Categories
504
436
201
183
173
Platforms
747
270
203
29
24
Products / Services
318
197
48
42
42
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
955
CVEs
4
3
2
2
2
IDS Classtypes
6
6
4
3
IDS Protocols
15
4
Detects XenoRAT command and control information stealer file access activity. XenoRAT reads browser profile data, including logins.json, Web Data, Cookies, Local Extension Settings, chromium_plugins, and profiles.ini, as well as cryptocurrency wallet files such as _key.txt, _v20.txt, and directories under Wallets. The detection triggers when a process executing from a writable or temporary path, or matching known XenoRAT hashes including MalwareBazaar samples and the UPX packed variant bb7f5743, accesses these paths under AppData or ProgramData. For higher confidence, correlate with xenorat_execution on the same host.
This rule detects potential credential harvesting and cryptocurrency wallet theft activities, specifically targeting browser data, SSH keys, cloud credentials, and crypto wallets. It looks for command-line patterns indicative of accessing or copying these sensitive files. The rule also includes a condition for Node.js processes attempting to exfiltrate credential-related data. The detection logic combines multiple conditions, such as browser credential access with SSH key theft, or cloud credential access with crypto wallet access, and Node.js exfiltration attempts combined with any of the credential/wallet access patterns.
Detects access to Chrome profile data and Login Data database associated with credential theft activities linked to FlexibleFerret malware on macOS.
Detects the collection and staging of sensitive user data, such as credentials from keychains, browser profiles, and cryptocurrency wallets, by compressing them into an archive. This behavior is a key component of the DigitStealer infostealer's data theft process.
ET MALWARE MEOWBACKCONN CnC Checkin
Detects the LANDFALL Android spyware components, specifically the 'b.so' loader and the 'l.so' SELinux policy manipulator.
Detects Airstalk malware, used by the CL-STA-1009 threat cluster. This rule identifies both PowerShell and .NET variants that misuse the AirWatch MDM API for C2 and data exfiltration.
Detects unauthorized access to Signal Desktop's sensitive data files, specifically 'db.sqlite' which stores encrypted messages and 'config.json' which contains the decryption key. An adversary gaining access to both files can decrypt and read sensitive messages without user credentials. The rule currently focuses on the default installation path in AppData\Roaming.
Yara rule that detects WeaselStore infostealer.
Detects potential data exfiltration activity associated with the 'Shai-Hulud' NPM package attack. This rule specifically looks for the execution of 'curl' with command-line arguments indicating data being sent ('-d') to a known malicious webhook.site URL.
The following analytic detects suspicious usage of BitLockerToGo.exe, which has been observed being abused by Lumma stealer malware. The malware leverages this legitimate Windows utility to manipulate registry keys, search for cryptocurrency wallets and credentials, and exfiltrate sensitive data. This activity is significant because BitLockerToGo.exe provides functionality for viewing, copying, and writing files as well as modifying registry branches - capabilities that the Lumma stealer exploits for malicious purposes. If confirmed malicious, this could indicate an active data theft campaign targeting cryptocurrency wallets, browser credentials, and password manager archives. The detection focuses on identifying BitLockerToGo.exe execution patterns that deviate from normal system behavior.
Detects a process accessing multiple sensitive files in WhatsApp or Google Chrome data folders, a technique used by Mysterious Elephant APT's exfiltration tools (Uplo, Stom, ChromeStealer).
This rule detects suspicious access to files with sensitive extensions commonly associated with email archives, database files, memory dumps, and remote desktop connection files. Monitoring access to these file types can indicate attempts at data collection, credential dumping, or lateral movement preparation by adversaries.
This analytic detects the creation of specific archived files, 'passff.tar' and 'cookie.tar', which are known indicators of IcedID malware exfiltrating sensitive browser information like history and cookies. The detection leverages Sysmon EventCode 11 to identify these file creations. This activity is critical as it signifies the potential compromise of sensitive user data, which could lead to further exploitation, data breaches, or escalation of attacker presence within the network.
This rule detects when processes other than Firefox or Windows Explorer attempt to access the Firefox profile directory. This directory contains sensitive user data like login credentials, browsing history, and cookies. Such activity, monitored via Windows Security Event 4663, could indicate malware (e.g., RATs, trojans) trying to harvest user information, potentially leading to data exfiltration, unauthorized account access, and system compromise.
The following analytic detects non-Chrome processes accessing the Chrome "Local State" file, which contains critical settings and information. It leverages Windows Security Event logs, specifically event code 4663, to identify this behavior. This activity is significant because threat actors can exploit this file to extract the encrypted master key used for decrypting saved passwords in Chrome. If confirmed malicious, this could lead to unauthorized access to sensitive information, posing a severe security risk. Monitoring this anomaly helps identify potential threats and safeguard browser-stored data.
This analytic identifies non-Chrome processes accessing the Chrome user data file "Login Data." This file is an SQLite database containing sensitive information, including saved passwords. The detection leverages Windows Security Event logs, specifically event code 4663, to monitor access attempts. This activity is significant as it may indicate attempts by threat actors to extract and decrypt stored passwords, posing a risk to user credentials. If confirmed malicious, attackers could gain unauthorized access to sensitive accounts and escalate their privileges within the environment.
This analytic detects the creation of `sqlite32.dll` or `sqlite64.dll` files within the `%temp%` directory. This activity is often associated with the IcedID malware, which utilizes sqlite3 modules to parse browser databases and exfiltrate sensitive information like banking details, credit card information, and credentials. Detection of this behavior could indicate data theft and compromise of user accounts.
Detects a series of Salesforce Object Query Language (SOQL) queries indicative of data reconnaissance and exfiltration, similar to techniques used by UNC6395.
Detects file access requests to browser credential stores by uncommon processes. This could indicate a potential attempt at credential stealing. This rule requires heavy baselining before usage to reduce false positives.
This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. Threat actors like Static Tundra have been observed configuring TFTP servers to make device configuration files accessible for exfiltration after gaining initial access. The detection specifically looks for commands that expose critical configuration files such as startup-config, running-config, and other sensitive system information through TFTP. This activity is particularly concerning as it may represent an attempt to steal credentials, network topology information, and other sensitive data stored in device configurations.
Page 42 of 46