Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
280 detections
Filters
Last updated
All Time
Detection languages
113
68
30
18
17
Contributors
91
44
38
32
7
Categories
148
66
58
36
33
Platforms
150
56
47
41
34
Products / Services
63
60
51
34
27
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
1
IDS Classtypes
14
11
4
1
1
IDS Protocols
23
4
1
1
Detects the presence of known malicious variants of the 'Adblock for YouTube' Chrome browser extension within the user's Chrome extensions directory. These extensions are flagged for utilizing broad host permissions to maintain persistent silent access and potential remote code execution via fetched scriptlets.
Detects a web session that proxies an enterprise authorisation endpoint while also handling session-cookie names associated with authenticated access. This rule identifies suspicious activity indicative of an Adversary-in-the-Middle (AiTM) attack where an attacker proxies authentication requests and steals session cookies.
Detects theft of browser session cookies for account takeover
Detects unauthorized processes attempting to interact with the elevation_service.exe (the Chrome App-Bound Encryption service) via COM mechanisms. This activity is a known indicator of the Glove Stealer 'five-tier ABE bypass' technique, which is used to decrypt browser-stored credentials and session cookies by abusing the service's interface.
Detects unauthorized processes attempting to read LevelDB or credential storage files belonging to common Electron-based applications (Discord, Signal, Slack, Teams, Telegram). This behavior is characteristic of info-stealer malware like Yuta or Glove Stealer that target browser and application-based session tokens.
Detects a non-browser process reading browser profiles, cookies, form stores, or session files from Chrome, Edge, Brave, or Opera browsers. The rule specifically looks for file events (creation, writing, deletion) on browser-related files like 'Cookies', 'Login Data', 'Web Data', 'History', or 'Local State' within browser user data directories, where the process performing the action has a filename matching common RAT patterns like 'banana', 'client', 'update', or 'service'.
This rule detects POST requests to the URI '/api/device/start' which is indicative of the EvilTokens phishing kit attempting to initiate a Microsoft OAuth Device Code flow. This technique is often used in phishing campaigns to gain unauthorized access to user accounts by tricking them into authenticating through a device code.
Detects the presence or installation of known malicious Adblock for YouTube browser extensions. These extensions are flagged for utilizing overly broad host permissions (e.g., <all_urls>) in conjunction with webRequest and scripting capabilities, which facilitates cross-site data collection, potential session hijacking, and the injection of malicious remote scripts.
Detects network activity associated with the 'Adblock for YouTube' Chrome extension (ID: cmedhionkhpnakcndndgjdbohmhepckk) as it retrieves malicious scripts from 'api.adblock-for-youtube.com'. These scripts are designed to access sensitive browser data, including session cookies, localStorage, and sessionStorage, and potentially interact with site-specific login form elements within the user's browser session.
Identifies an Azure Active Directory (AAD) sign-in using a session token from an anomalous location accessing Workday/ADP SSO endpoints. This rule specifically looks for non-interactive sign-ins to Workday or ADP applications where the user's sign-in locations change rapidly (multiple distinct locations within a 10-minute window), which could indicate a session cookie hijack.
Detects unauthorized access (File Creation, Modification, Rename, or Deletion) to common web browser cookie and credential storage files by non-browser processes. This behavior is a common indicator of information-stealing malware attempting to extract session cookies and credentials for later use.
Detects instances where non-browser processes attempt to open a handle to common web browsers (Chrome, Edge, Firefox). This behavior is indicative of unauthorized memory access or process injection techniques often used to harvest session cookies or other sensitive data stored in browser memory space.
Identifies a single IP address (the attacker) accessing multiple distinct enterprise applications (Exchange, SharePoint, Teams) in rapid succession using a hijacked cookie.
Detects malicious browser extension behavior where code injection into the MAIN world context is used to access browser session cookies or credential stores. This pattern is characteristic of BadBlocker and similar variants that use remotely-fetched scripts to perform session hijacking.
Detects browser process command line arguments indicating the execution of malicious adblock extensions. The detection identifies these extensions by their known Chrome Extension IDs, observation of requests to specific command-and-control API endpoints, and attempts to execute JavaScript in the MAIN browser world to access sensitive session cookies via document.cookie, cookieStore.getAll, or chrome.cookies.getAll.
Detects a web session that proxies an enterprise authorisation endpoint while also handling session-cookie names associated with authenticated access. This rule identifies suspicious activity indicative of an Adversary-in-the-Middle (AiTM) attack where an attacker proxies authentication requests and steals session cookies.
Detects unauthorized access to browser credential storage files (e.g., Login Data, Cookies, Local State) by suspicious non-browser processes such as node.exe, powershell.exe, or wscript.exe. This activity is often associated with infostealer malware, particularly in supply chain attacks where malicious scripts attempt to dump browser-saved credentials or session cookies.
Detects suspicious access attempts by non-native processes to sensitive application data such as Discord local state, Telegram tdata, Steam SSFN tokens, and Roblox session cookies. This activity could indicate an attempt to steal session tokens or credentials for unauthorized access.
Detects unauthorized access (File Creation, Modification, Rename, or Deletion) to common web browser cookie and credential storage files by non-browser processes. This behavior is a common indicator of information-stealing malware attempting to extract session cookies and credentials for later use.
Detects instances where non-browser processes access sensitive browser-related files (Login Data, Cookies, or Local State) located within AppData directories. This behavior is highly indicative of credential and session token theft, often associated with AiTM or post-compromise information harvesting activities.
This rule detects POST requests to the URI '/api/device/start' which is indicative of the EvilTokens phishing kit attempting to initiate a Microsoft OAuth Device Code flow. This technique is often used in phishing campaigns to gain unauthorized access to user accounts by tricking them into authenticating through a device code.
Page 11 of 14