Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
956 detections
Filters
Last updated
All Time
Detection languages
486
122
65
63
57
Contributors
328
210
131
82
29
Categories
504
436
202
184
173
Platforms
748
270
203
29
24
Products / Services
318
197
48
42
42
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
956
CVEs
4
3
2
2
2
IDS Classtypes
6
6
4
3
IDS Protocols
15
4
Detects unauthorized processes (excluding firefox.exe and explorer.exe) accessing or modifying sensitive Firefox browser profile files, specifically places.sqlite (history/bookmarks) and cookies.sqlite (session cookies). This activity is often indicative of credential or session hijacking attempts by malware or malicious scripts.
Detects unauthorized processes attempting to access Discord's local storage (LevelDB) where authentication tokens are stored, followed by a network request to the Discord API user validation endpoint, which is a pattern indicative of token extraction and liveness testing by malware.
This rule detects the use of the macOS 'security' utility to unlock the login keychain and modify its access-control list, a technique observed in PamStealer malware to facilitate subsequent unauthorized access to the keychain database.
This rule detects non-standard processes attempting to access sensitive web browser files (e.g., 'Login Data', 'Cookies', 'key4.db') that are typically only accessed by legitimate web browsers. It excludes known browser processes and trusted security or sync applications to identify potential credential theft attempts.
Detects non-browser processes performing file operations (create, modify, rename) on known web browser credential storage, configuration files, and cryptocurrency wallet artifacts in a short duration. This behavior is indicative of credential harvesting or information stealing activity often associated with malware like Vidar, which stages these sensitive files for exfiltration.
Detects non-browser processes performing file operations (create, modify, rename) on known web browser credential storage, configuration files, and cryptocurrency wallet artifacts in a short duration. This behavior is indicative of credential harvesting or information stealing activity often associated with malware like Vidar, which stages these sensitive files for exfiltration.
Detects non-browser processes performing file operations (create, modify, rename) on known web browser credential storage, configuration files, and cryptocurrency wallet artifacts in a short duration. This behavior is indicative of credential harvesting or information stealing activity often associated with malware like Vidar, which stages these sensitive files for exfiltration.
Detects the loading of the 'WbElevation.dll' module associated with SectopRAT, followed by suspicious access to browser, email, or cryptocurrency wallet credential stores within a 10-minute window on the same device.
Detects the loading of the 'WbElevation.dll' module associated with SectopRAT, followed by suspicious access to browser, email, or cryptocurrency wallet credential stores within a 10-minute window on the same device.
Detects instances of common interpreter processes, specifically node.exe or python variants, accessing known cryptocurrency wallet files or mnemonic storage files on a Windows system. This behavior is highly indicative of malicious activity where an attacker uses lightweight script-based tools to perform credential harvesting or theft of cryptocurrency assets.
Detects hosts exhibiting multiple distinct file-manipulation commands (upload, download, stop, delete, append, copy, move) within a single session as identified by the PivotPipe C2 protocol, indicating potential staging, collection, or exfiltration activity.
Detects the use of legitimate data transfer utilities (s5cmd, rclone) configured to exfiltrate sensitive document types (.doc, .pdf, .sql, etc.) to S3-compatible cloud storage. The rule correlates this activity with recent access to files containing sensitive credentials or configuration data, a pattern observed in double-extortion campaigns.
Detects the 'comet.exe' process (Perplexity AI agent) performing file read, write, rename, or creation operations outside of standard browser paths (e.g., AppData, Temp, Downloads). This behavior potentially indicates the process is being leveraged for unauthorized data access or staging files on the local filesystem.
Detects unauthorized access to common browser credential and cookie files by processes other than standard web browsers. This activity is a common indicator of credential harvesting malware or unauthorized data collection.
Detects potential path traversal or unauthorized access attempts by Semantic Kernel Agents (or related processes like Python/DotNet) to sensitive host files. The rule monitors for file read, creation, or modification activities targeting sensitive credentials, configuration files (e.g., .ssh, .aws, .kube), and system files, which could indicate a sandbox escape or malicious data collection.
Detects unauthorized processes (non-browser) reading sensitive browser session and credential files (e.g., Cookies, Login Data) across multiple user profiles, followed by immediate outbound network connections. This behavior is highly characteristic of commodity information stealers (e.g., LummaC2, Stealc, Vidar) attempting to exfiltrate browser-stored credentials and session data.
Detects instances where a Semantic Kernel AI agent, running via Python or .NET, accesses sensitive local files like SSH keys, cloud credentials, or environment files immediately before triggering a potential file upload operation.
Detects execution of xcopy with specific flags intended to perform recursive copying of files, including hidden and system files, into a staging directory located within C:\Users\Public\. This behavior matches the known exfiltration collection routine of the NarwhalRAT malware, often invoked by processes such as python.exe or userscreen.exe.
Detects instances where non-browser processes (e.g., cmd, powershell, or malicious binaries) attempt to access sensitive browser files such as 'Login Data' or 'Local State'. This is a common technique used by credential stealers to exfiltrate stored browser passwords, cookies, and configuration data.
Detects unauthorized processes attempting to read or manipulate local storage, session storage, or database files associated with messaging applications like Telegram and WhatsApp, or email clients like Outlook and Thunderbird. This behavior is indicative of credential or data theft by malicious software or unauthorized scripts.
Detects activity related to potential browser credential theft, specifically targeting Chrome and Microsoft Edge. The rule monitors for the loading of a specific suspicious file, the presence of browser-specific decryption artifacts such as 'browser_decryption.log' or 'ProtectR3.dll', and process command-line arguments containing keywords like 'DecryptData' or 'Elevation Service' associated with browser credential extraction.
Page 9 of 46