Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
115 detections
Filters
Last updated
All Time
Detection languages
53
14
11
10
7
Contributors
31
25
17
8
6
Categories
28
27
26
23
19
Platforms
88
37
34
8
7
Products / Services
46
14
8
7
7
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
1
1
IDS Classtypes
4
3
IDS Protocols
7
Detects browser navigation to sensitive Google account pages (e.g., myaccount.google.com/contactemail) occurring within 10 seconds of a browser extension installation. This pattern is consistent with automated redirects used to trigger Cross-Site Scripting (XS-Leak) vulnerabilities, potentially allowing attackers to exfiltrate sensitive user data or information via malicious extensions before the user can intervene.
Detects a potential SSRF-based exfiltration attempt by correlating DNS traffic. The rule identifies a browser session that accesses M365 Copilot (m365.cloud.microsoft) followed by a connection to Bing (bing.com), which is indicative of the exfiltration technique associated with CVE-2026-42824 involving the Bing 'searchbyimage' feature.
Detects unauthorized processes attempting to access sensitive browser data files (Login Data, Cookies, Web Data) that are typically used by web browsers to store credentials and session information. The rule filters out known legitimate browser processes, flagging potential credential theft or session hijacking activity.
Detects instances where the Outlook process (OUTLOOK.EXE) initiates a network connection via port 445 (SMB) to an IP address that is not part of the internal private network ranges. This activity is highly anomalous for an email client and may indicate exploitation, data exfiltration, or attempts to relay NTLM credentials to a remote malicious SMB server.
This rule detects the installation of a new Microsoft Edge extension followed by suspicious network activity from the msedge.exe process within 24 hours. The suspicious activity includes the fetching of common steganography-friendly file types (e.g., .png, .webp, .woff2, .conf) from known StegoAd C2 domains. This behavior is indicative of a malicious extension retrieving payloads hidden in legitimate-looking media files or beaconing to attacker infrastructure.
Detects modifications to Chrome or Chromium browser preference files that indicate either the installation of a specific malicious extension or the overriding of the default search provider to a known suspicious domain (perplexity-ai.online). This indicates potential browser-based persistence or search hijacking.
Detects anomalous network activity from browser renderer subprocesses (chrome.exe/msedge.exe) correlated with concurrent file system access to sensitive browser credential stores (Login Data/Cookies). The rule identifies high-frequency outbound connections following or occurring during access to these files, which is a common indicator of credential exfiltration performed by malicious browser extensions or injected scripts.
This rule detects potential session token replay attacks against Okta by identifying a single Okta session (externalSessionId) being used from multiple distinct origins. It specifically looks for divergence in device identity (dtHash), operating system (OS), or client country within the same session, rather than just multiple IP addresses. This behavior is indicative of a stolen post-MFA cookie being replayed by an attacker.
Detects the installation of specific browser extensions in Microsoft Edge followed by network connection activity to external IP addresses. This behavior is indicative of potential malicious browser extensions, such as those used for browser session hijacking, credential theft, or command and control (C2).
Detects network communication to the malicious domain 'mitarchive.info' from common web browsers (Chrome, Edge, Firefox, Brave). This domain is associated with the StegoAd browser extension, which intercepts Google and WordPress login flows to exfiltrate stolen credentials and 2FA codes.
Detects file creation or modification events associated with the known malicious Chromium extension 'Search for perplexity ai' (ID: flkebkiofojicogddingbdmcmkpbplcd). The rule monitors for the installation of the extension and the creation of its declarativeNetRequest rule files (perplexity-rules.json, bing-rules.json, google-rules.json), which are used to hijack browser search queries and redirect them to a typosquatted domain.
Detects instances where the Outlook process (OUTLOOK.EXE) initiates a network connection via port 445 (SMB) to an IP address that is not part of the internal private network ranges. This activity is highly anomalous for an email client and may indicate exploitation, data exfiltration, or attempts to relay NTLM credentials to a remote malicious SMB server.
Detects HTTP requests that reference or serve the 'cors_exploit_poc.html' file, which is associated with the MexicanMafia (Operation Escaneo) actor's method of exploiting Cross-Origin Resource Sharing (CORS) misconfigurations. This exploit attempts to hijack active administrative sessions by leveraging CORS with 'withCredentials=true'.
Detects network activity associated with the BadBlocker for YouTube browser extension (ID: cmedhionkhpnakcndndgjdbohmhepckk). The rule identifies DNS queries and outbound network connections to known command-and-control (C2) domains (api.adblock-for-youtube.com, get.adblock-for-youtube.com) used by the extension to exfiltrate session cookies and other sensitive browser data.
Detects outbound network traffic from browser processes to known BadBlocker extension command-and-control infrastructure (api.adblock-for-youtube.com or get.adblock-for-youtube.com), followed by subsequent outbound HTTPS connections to arbitrary external domains. This sequence is indicative of malicious browser extension activity involving the exfiltration of session cookies or authentication tokens from the victim's browser.
Detects anomalous browser activity where an endpoint retrieves configuration or scriptlets from the BadBlocker-related API, followed shortly by outbound network connections to suspicious domains or the exfiltration of sensitive browser-based session data like document.cookie, localStorage, or sessionStorage.
This rule detects when a user account repeatedly (3 or more times within an hour) requests either 'SeDebugPrivilege' or 'SeImpersonatePrivilege' (Event ID 4672). This behavior can be indicative of an attacker attempting to escalate privileges or manipulate access tokens, often seen in techniques like token impersonation or debugging processes for malicious purposes.
Detects instances where a single authentication correlation ID is associated with multiple distinct IP addresses within a 10-minute window, followed by high-risk administrative or data-access actions within 30 minutes. This behavior is indicative of session hijacking or post-authentication account compromise, where an adversary uses stolen session tokens to perform unauthorized activities.
Detects browsers loading external anomalous scripts from known malvertising domains while visiting plaintext HTTP sites (Router injection). This rule specifically looks for network connections on port 80 (HTTP) that are joined with device network events where the remote URL matches a regex for known malvertising domains (.xyz, .top, .site) and ends with '.js', indicating an injected script.
Detects potential Browser-in-the-Middle (BitM) session hijacking by identifying scenarios where a single user account authenticates successfully from multiple geographically distinct external IP addresses within a short (10-minute) window, suggesting a parallel session is being used by an attacker.
This rule detects activity associated with malicious or intrusive browser extensions, specifically identifying network connections to a known malicious command-and-control (C2) endpoint, execution of specific scriptlet keywords related to MAIN-world injection in browser processes, and the presence of known 'BadBlocker' extension IDs on endpoints.
Page 4 of 6