Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
280 detections
Filters
Last updated
All Time
Detection languages
113
68
30
18
17
Contributors
91
44
38
32
7
Categories
148
66
58
36
33
Platforms
150
56
47
41
34
Products / Services
63
60
51
34
27
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
1
IDS Classtypes
14
11
4
1
1
IDS Protocols
23
4
1
1
Detects Microsoft 365 OAuth access tokens issued via device_code grant — the mechanism abused by the EvilTokens phishing kit — followed within 1 hour by mailbox forwarding rule creation for the same account, indicating persistent BEC access post-compromise.
This rule monitors Microsoft Entra ID (Azure AD) sign-ins for indicators associated with the 'Payroll Pirate' campaign. It identifies non-interactive OAuth/token-based authentication requests originating from residential Internet Service Provider (ISP) ASNs using devices marked as unmanaged. It further elevates risk by detecting impossible travel (same user accessing from multiple IPs in a short window) and the use of specific browser User-Agent strings (Firefox or Axios) characteristic of the threat actor's tooling.
Detects unauthorized access, copy, or read operations against Chromium-based browser cookie database files by processes other than standard browsers. This behavior is indicative of session hijacking, a technique observed in malware like TONResolver and Millenium RAT to extract authentication tokens for subsequent adversary-in-the-middle or session theft attacks.
Detects a suspicious pattern where a user successfully authenticates via MFA, followed by another successful sign-in attempt for the same account within 10 minutes using a different IP address or user agent. This behavior is often indicative of session hijacking or adversary-in-the-middle (AiTM) attacks where a session token is stolen and replayed from an attacker-controlled environment.
Detects instances where browser processes (msedge.exe, chrome.exe) copy sensitive credential and session SQLite databases (e.g., Login Data, Cookies) to locations outside of the canonical User Data directories. This behavior is indicative of the StegoAd campaign, where malicious browser extensions stage these files for subsequent exfiltration.
This rule detects potential post-compromise mailbox reconnaissance by correlating suspicious sign-in events (non-interactive or unmanaged device usage, often associated with AiTM token replay) with subsequent mailbox or compliance search operations targeting payroll and HR-related keywords within a 60-minute window.
Detects potential Microsoft 365 session token replay attacks, often associated with Adversary-in-the-Middle (AiTM) kits. The rule identifies suspicious sign-in activity originating from proxy or anonymized IP addresses where MFA was bypassed or incomplete, coupled with a geographic location that deviates from the user's established 30-day baseline or constitutes a new, unseen location.
Detects unauthorized processes, such as TaskWeaver implants or scripts (node.exe, wscript.exe, cscript.exe) running from non-standard directories (e.g., %TEMP%, %APPDATA%), attempting to access web browser credential databases. This behavior is indicative of post-exploitation credential harvesting, specifically linked to Djinn Stealer activity following CVE-2026-48558 exploits.
Detects instances where a user successfully authenticates using Multi-Factor Authentication (MFA) from one location, followed by a Single-Factor Authentication (SFA) logon from a different location within a 10-minute window. This behavior is indicative of potential session hijacking or session cookie theft where an attacker reuses an authenticated session or manipulates the authentication flow to bypass MFA requirements.
Identifies anomalous session cookie replays where a user token logs in without interactive MFA from an entirely different geographic location within minutes. This rule specifically looks for non-interactive sessions (IsInteractive == false) where a single AccountUpn (user) has IP addresses from two or more distinct geographic locations within a 30-minute window.
Detects potential Adversary-in-the-Middle (AiTM) activity by monitoring for suspicious browser process spawning scripting child processes (powershell.exe, wscript.exe, etc.), unusual DNS requests to Microsoft login/Graph API endpoints from scripting hosts, and direct non-browser access to browser cookie database files.
Detects Microsoft 365 OAuth access tokens issued via device_code grant — the mechanism abused by the EvilTokens phishing kit — followed within 1 hour by mailbox forwarding rule creation for the same account, indicating persistent BEC access post-compromise.
This rule detects processes other than standard web browsers (Chrome, Edge, Brave) attempting to access sensitive directories within Chrome extension user data paths, such as IndexedDB, Local Storage, or Sync Data. Such activity is often indicative of credential or session cookie theft by malicious scripts or malware.
Detects unauthorized processes attempting to access sensitive local browser files (credential stores, cookies, and local state databases) associated with Chrome, Edge, Brave, Chromium, and Firefox. Such access is a primary indicator of infostealer malware attempting to harvest saved credentials and session cookies from a victim's machine.
Detects unauthorized access to sensitive browser credential files (Login Data, Cookies, logins.json) by processes other than standard browsers or known security products. This activity is a common indicator of credential harvesting by infostealer malware families aiming to compromise saved passwords and session cookies.
Detects attempts to access browser credential stores or LSASS process memory by unexpected processes. This rule identifies suspicious file access patterns to browser login data files (Chrome, Edge, Firefox, Brave) by non-browser executables, as well as unauthorized access to LSASS process memory via Sysmon Event ID 10 or Windows Security Event 4656 by non-system processes. These activities are indicative of credential dumping or theft.
Detects unauthorized non-browser processes attempting to access sensitive credential and session cookie files associated with major web browsers such as Chrome, Edge, and Firefox. This behavior is indicative of credential harvesting techniques often utilized by infostealer malware, including variants of the Millenium RAT, to extract stored passwords and session tokens.
Identifies geographic impossible travel where the device code was requested in one country and successfully authenticated from another within minutes. This rule looks for a single AccountUpn having activity from two or more distinct locations within a 10-minute window.
Detects attempts by explorer.exe to access browser credential and cookie files from common web browsers (Chrome, Edge, Firefox). This activity is highly suspicious as explorer.exe is not typically involved in legitimate access to these sensitive files, suggesting potential credential theft or reconnaissance.
This rule detects attempts by common scripting or utility processes (like osascript, curl, zsh, bash, sh, python) to access sensitive macOS files, specifically targeting browser data (Chrome, Brave, Firefox) and keychain files. This activity could indicate an attacker attempting to exfiltrate credentials, session tokens, or other sensitive user data.
Detects malicious browser extension activity related to the StegoAd infostealer. The rule identifies a dual-indicator pattern consisting of outbound network connections to 'mitarchive.info' combined with concurrent read access to browser-specific credential store files (Google Chrome, Microsoft Edge, Mozilla Firefox) on the same host.
Page 9 of 14