Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
339 detections
Filters
Last updated
All Time
Detection languages
120
95
28
25
18
Contributors
111
38
29
22
22
Categories
227
127
107
45
27
Platforms
254
58
57
11
10
Products / Services
76
70
29
21
17
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
2
2
1
1
1
IDS Classtypes
7
1
IDS Protocols
8
Detects unauthorized access by scripting engines (node.exe, bun.exe, python.exe) to configuration, task files, or sensitive credential stores associated with AI coding assistants and IDEs such as Cursor, Claude, Gemini, and VS Code. This pattern is consistent with the behavior of the Miasma worm, which attempts to exfiltrate developer tokens or environment configurations.
Detects the execution of 'filemanager.exe', a standalone credential stealer associated with the DeepLoad malware. This executable is designed to harvest browser passwords and is typically found running from user-specific application data directories such as AppData\Local, AppData\Roaming, or Temp.
This rule detects when the Remcos RAT loader attempts to access browser cache folders (Chrome, Firefox, Opera). This activity is indicative of credential dumping, where the malware tries to extract sensitive information like stored passwords or session tokens from web browsers.
This rule detects attempts by non-browser processes to access sensitive Chromium-based browser files such as 'Login Data', 'Cookies', 'History', 'Web Data', and 'Local State'. These files often contain credentials, browsing history, and other sensitive user data. The rule specifically filters for file access events where the accessing process's command line does not match known browser executables (chrome.exe, msedge.exe, brave.exe, opera.exe, vivaldi.exe), indicating potential credential theft or data exfiltration by malicious software.
This rule detects a suspicious sequence of events: first, a modification to the 'ExtensionInstallForcelist' registry key, followed within one hour by access to browser credential stores (specifically 'Login Data' or 'Cookies' files). This combination suggests an attacker might be attempting to force the installation of a malicious browser extension to steal credentials.
Google Threat Intelligence Group (GTIG) has identified a sophisticated campaign attributed to UNC6508, a People's Republic of China (PRC)-nexus threat actor, targeting institutions in the North American academic, medical, and military research community. While remaining undetected for over a year, the threat actor compromised externally facing web applications, deployed bespoke malware, pivoted to sensitive internal systems, and abused enterprise administrative tools for covert data exfiltration. The threat actor had broad collection aspirations, including sensitive defense intelligence related to national security, Indo-Pacific command operations, artificial intelligence, uncrewed vehicle systems, cyber offensive programs, and medical research.
Identifies when the AutoIt3.exe process accesses cryptocurrency wallet files or directories such as MetaMask, Exodus, Coinomi, or wallet.dat. This behavior is indicative of information stealer malware like Vidar attempting to exfiltrate sensitive cryptocurrency data.
Detects the modified ScreenConnect calling DPAPI encryption routines natively to hide the C2 configuration variables.
Detects a file containing a cluster of strings commonly associated with Chromium credential stealing malware. The strings include references to Chromium profile database files like 'Login Data', 'Network\Cookies', 'History', and 'Web Data', as well as 'Local State' (often used for encryption keys) and the Windows API function 'CryptUnprotectData', which is used to decrypt DPAPI-protected data.
Detects pythonw.exe accessing multiple distinct browser credential stores within a tight 2-minute window, indicative of information stealer behavior (e.g., Vidar stealer). The rule specifically looks for access to 'Login Data', 'Cookies', 'Web Data', and 'places.sqlite' files.
This rule detects the dynamic compilation of C# code using csc.exe followed by immediate access to DPAPI (Data Protection API) vault files. This sequence of events can indicate an adversary compiling and executing code on the fly to decrypt or access sensitive credentials protected by DPAPI.
Detects Python searching local vaults and configuration for password managers such as KeePass, 1Password, Bitwarden, or LastPass. This activity is associated with the InvisibleFerret malware.
Detects AppleScript execution attempting to harvest user passwords through dialog boxes with hidden answer parameters. This technique is commonly used by macOS infostealers like Poseidon and Banshee.
This rule detects when the ScreenConnect process accesses DPAPI-related files, specifically those within the 'Protect\S-1-5-21-' folder. This activity is indicative of credential theft, as observed in the 'Operation SilentCanvas' campaign where a trojanized ScreenConnect was used for this purpose.
Detects a non-browser process searching for Chromium Login Data, Cookies, Local State, or Firefox logins and key databases. This activity is indicative of credential access attempts where an attacker tries to extract sensitive information stored by web browsers.
The "Miasma" npm supply chain attack exploits native build processes using a weaponized binding.gyp file to execute self-propagating malware and steal CI/CD credentials. This worm automates the infection of dozens of packages by bypassing security scanners, targeting cloud secrets, and forging provenance
Ref: https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm
Ref: https://www.stepsecurity.io/blog/binding-gyp-npm-supply-chain-attack-spreads-like-worm
This rule detects events generated by Microsoft Defender for Endpoint's Attack Surface Reduction (ASR) rules in either Audit or Block mode.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
This rule detects the Deno runtime accessing sensitive browser profile data (Login Data, Cookies, Local State) and cryptocurrency wallet directories (Wallet, Electrum, Exodus, MetaMask) on the same machine. This dual access pattern is indicative of infostealer malware, often distributed as fake coding utilities. End-user PCs should rarely run Deno, making such activity highly suspicious.
This rule detects the exfiltration of a password store database over HTTP POST. It specifically looks for HTTP POST requests where the URI or content contains the string "passwords" (case-insensitive) and the data size is greater than 1000 bytes. This combination suggests a large file, potentially a database, containing passwords being sent out of the network.
On April 29, 2026, attackers compromised four SAP-related npm packages (mbt, @cap-js/db-service, @cap-js/sqlite, @cap-js/postgres) with a Bun-based credential stealer branded “Mini Shai-Hulud.” The malware harvested developer secrets, created GitHub dead-drop repos, and introduced novel persistence mechanisms in IDE and CI pipelines.
No description available.
Page 12 of 17