Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
280 detections
Filters
Last updated
All Time
Detection languages
113
68
30
18
17
Contributors
91
44
38
32
7
Categories
148
66
58
36
33
Platforms
150
56
47
41
34
Products / Services
63
60
51
34
27
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
1
IDS Classtypes
14
11
4
1
1
IDS Protocols
23
4
1
1
Detects anomalous authentication patterns indicative of session token replay attacks. The rule identifies instances where a user successfully performs an MFA-authenticated, interactive sign-in, followed shortly (within 5-60 minutes) by a single-factor sign-in for the same user. The suspicious activity is characterized by a shift to a different IP/ASN, an unmanaged device (non-trusted), and a change in browser or OS identifiers, all while the user's geolocation (city/country) remains consistent. This behavioral pattern is highly consistent with the use of residential proxy infrastructure to replay stolen session tokens, effectively bypassing MFA.
Detects potential session replay or cookie theft attacks against Google Workspace accounts. The rule identifies anomalous session activity where a single session ID is associated with multiple country codes within a short timeframe (less than 60 minutes), suggesting that a stolen session token is being used by an adversary in a different location than the legitimate user.
Detects PEEP credential/session theft via the native-messaging bridge, native host registration, staged CRX, or extension ID references. The nm_host.exe branch is now anchored to the known PEEP extension IDs (primary and alternate build) or the com.peep.lab path, rather than firing on any nm_host.exe spawned by a browser.
Detects PEEP credential/session theft via the native-messaging bridge, native host registration, staged CRX, or extension ID references. The nm_host.exe branch is now anchored to the known PEEP extension IDs (primary and alternate build) or the com.peep.lab path, rather than firing on any nm_host.exe spawned by a browser.
Detects outbound network connections to 'registry.npmjs.org' originating from 'node' or 'bun' processes. This behavior may indicate an attempt to exfiltrate data, interact with malicious packages, or perform credential harvesting via npm tokens during execution.
Detects indicators of cross-site scripting (XSS) attacks aimed at stealing web session cookies. The rule covers the injection of malicious scripts into client responses, anomalous CORS preflight responses that could facilitate data exfiltration, and subsequent HTTP callbacks or beaconing containing cookie data to external endpoints.
Detects potential session replay or cookie theft attacks against Google Workspace accounts. The rule identifies anomalous session activity where a single session ID is associated with multiple country codes within a short timeframe (less than 60 minutes), suggesting that a stolen session token is being used by an adversary in a different location than the legitimate user.
The detection rule identifies an suspicious process named 'msgbox.exe' attempting to interact with browser configuration files ('Secure Preferences') and activity directories ('stomp_ext'), while simultaneously invoking browser processes ('chrome.exe' or 'msedge.exe') with the '--restore-last-session' argument. This behavior is indicative of an adversary attempting to force-load a browser session or hijack browser state, potentially to steal session cookies or credentials.
Detects anomalous authentication patterns indicative of session token replay attacks. The rule identifies instances where a user successfully performs an MFA-authenticated, interactive sign-in, followed shortly (within 5-60 minutes) by a single-factor sign-in for the same user. The suspicious activity is characterized by a shift to a different IP/ASN, an unmanaged device (non-trusted), and a change in browser or OS identifiers, all while the user's geolocation (city/country) remains consistent. This behavioral pattern is highly consistent with the use of residential proxy infrastructure to replay stolen session tokens, effectively bypassing MFA.
Detects anomalous authentication patterns indicative of session token replay attacks. The rule identifies instances where a user successfully performs an MFA-authenticated, interactive sign-in, followed shortly (within 5-60 minutes) by a single-factor sign-in for the same user. The suspicious activity is characterized by a shift to a different IP/ASN, an unmanaged device (non-trusted), and a change in browser or OS identifiers, all while the user's geolocation (city/country) remains consistent. This behavioral pattern is highly consistent with the use of residential proxy infrastructure to replay stolen session tokens, effectively bypassing MFA.
Detects anomalous authentication patterns indicative of session token replay attacks. The rule identifies instances where a user successfully performs an MFA-authenticated, interactive sign-in, followed shortly (within 5-60 minutes) by a single-factor sign-in for the same user. The suspicious activity is characterized by a shift to a different IP/ASN, an unmanaged device (non-trusted), and a change in browser or OS identifiers, all while the user's geolocation (city/country) remains consistent. This behavioral pattern is highly consistent with the use of residential proxy infrastructure to replay stolen session tokens, effectively bypassing MFA.
Detects PEEP credential/session theft via the native-messaging bridge, native host registration, staged CRX, or extension ID references. The nm_host.exe branch is now anchored to the known PEEP extension IDs (primary and alternate build) or the com.peep.lab path, rather than firing on any nm_host.exe spawned by a browser.
Detects anomalous authentication patterns indicative of session token replay attacks. The rule identifies instances where a user successfully performs an MFA-authenticated, interactive sign-in, followed shortly (within 5-60 minutes) by a single-factor sign-in for the same user. The suspicious activity is characterized by a shift to a different IP/ASN, an unmanaged device (non-trusted), and a change in browser or OS identifiers, all while the user's geolocation (city/country) remains consistent. This behavioral pattern is highly consistent with the use of residential proxy infrastructure to replay stolen session tokens, effectively bypassing MFA.
Detects indicators of cross-site scripting (XSS) attacks aimed at stealing web session cookies. The rule covers the injection of malicious scripts into client responses, anomalous CORS preflight responses that could facilitate data exfiltration, and subsequent HTTP callbacks or beaconing containing cookie data to external endpoints.
Detects potential session replay or cookie theft attacks against Google Workspace accounts. The rule identifies anomalous session activity where a single session ID is associated with multiple country codes within a short timeframe (less than 60 minutes), suggesting that a stolen session token is being used by an adversary in a different location than the legitimate user.
Detects the execution of BrowserCore.exe, a native messaging component for web browsers, when combined with command-line redirection (< or >) or specific output file creation (e.g., prt_cookie.txt, formatted_nonce.txt). This behavior is characteristic of an attack designed to extract Primary Refresh Tokens (PRTs) or browser cookies, which can be used to bypass authentication mechanisms.
Detects potential session replay or cookie theft attacks against Google Workspace accounts. The rule identifies anomalous session activity where a single session ID is associated with multiple country codes within a short timeframe (less than 60 minutes), suggesting that a stolen session token is being used by an adversary in a different location than the legitimate user.
Detects potential session replay or cookie theft attacks against Google Workspace accounts. The rule identifies anomalous session activity where a single session ID is associated with multiple country codes within a short timeframe (less than 60 minutes), suggesting that a stolen session token is being used by an adversary in a different location than the legitimate user.
Detects unauthorized processes attempting to read sensitive browser credential and session data (e.g., 'Login Data', 'Cookies', 'Local State', 'cookies.sqlite', 'logins.json') located in common browser profile paths. This behavior is highly indicative of information-stealing malware attempting to extract saved passwords and session cookies for account hijacking and 2FA/SSO bypass.
Detects browser-side storage artifacts (JWRCID, JwrExecutedInstructions, JwrCvvForm) persisted by the JWR phishing kit in a victim's browser session/local storage.
Detects curl reusing a captured cookie jar (-b /tmp/lhr_c) against a known tunnel domain, indicating session-cookie replay to hijack an authenticated session exposed via a reverse tunnel.
Page 6 of 14