Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
281 detections
Filters
Last updated
All Time
Detection languages
114
68
30
18
17
Contributors
91
44
38
32
7
Categories
148
66
59
36
33
Platforms
150
57
47
41
34
Products / Services
64
60
51
34
27
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
2
1
IDS Classtypes
14
11
4
1
1
IDS Protocols
23
4
1
1
This rule detects suspicious Okta login attempts where a stolen web session cookie might be reused. It specifically looks for a single user (identified by `userid`) attempting to log in from multiple distinct IP addresses AND from multiple distinct browsers or operating systems within a one-hour window. This behavior is indicative of an adversary attempting to bypass authentication mechanisms by replaying a stolen session cookie from a different device or location.
Detects when an adversary attempts to reuse a stolen web session cookie in a different device that has a different OS, IP, Browser or User Agent.
Yara rule that detects GomorrahStealer infostealer.
This YARA rule detects the Daolpu infostealer by identifying specific byte patterns related to its core functionalities. These functionalities include network communication, searching for sensitive files on the system, parsing Firefox configuration files, and collecting browser passwords and cookies. The rule requires all these distinct patterns to be present within a file to trigger a detection, aiming to reduce false positives.
This rule detects the execution of the 'sqlite' or 'sqlite3' binary specifically when it is used to query sensitive data from Chromium-based browser profiles. The detection logic looks for command-line arguments that indicate access to common Chromium user data paths and specific database files containing login data, cookies, web data (credit cards, autofill), history, or bookmarks. This activity is highly indicative of an attempt to steal sensitive user information stored by web browsers.
Detects the usage of the 'sqlite' or 'sqlite3' binaries to query specific database files associated with Firefox and other Gecko-based browsers, such as 'cookies.sqlite' and 'places.sqlite'. This activity is indicative of potential data stealing, particularly targeting browser history, bookmarks, and session cookies.
Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.
Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.
Page 14 of 14