Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
339 detections
Filters
Last updated
All Time
Detection languages
120
95
28
25
18
Contributors
111
38
29
22
22
Categories
227
127
107
45
27
Platforms
254
58
57
11
10
Products / Services
76
70
29
21
17
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
2
2
1
1
1
IDS Classtypes
7
1
IDS Protocols
8
This rule detects the creation of processes that utilize specific mutex names associated with the Exela stealer. The detection is triggered when a process creates a mutex with the name 'Exela | Stealar | on top |'. This activity is indicative of the Exela stealer operating on a system, as these mutexes are known to be used by this malware family for various purposes, such as ensuring single instance execution or inter-process communication. The rule leverages process creation logs to identify the presence of these mutexes.
The rule detects the creation of specific mutexes ('ICollectVASD') which are known to be associated with the Ducktail stealer malware. This indicates potential Ducktail stealer activity on the system, aiming to prevent multiple instances of the malware from running simultaneously.
This rule detects the creation of specific mutexes that are known to be associated with the Mars Stealer malware. The rule looks for three distinct mutex names: '67820366929896267194', '92550737836278980100', and '86223203794583053453'. The detection is based on process creation logs from Windows systems, specifically monitoring for these unique mutex names. The presence of any of these mutexes indicates potential Mars Stealer activity on the system.
The rule detects the creation of specific mutexes known to be associated with the Lumma stealer malware. It looks for a mutex named 'sodfksdkfalksdasgpkprgasdgrrkgwhrterheegwsdfwef'. The detection is based on process creation events in Windows environments.
Detects when a Visual Studio Code process (Code.exe) or its underlying Node.js process accesses sensitive user directories or files. This could indicate the exploitation of a vulnerable extension, such as in CVE-2025-65717, to steal credentials or other sensitive data.
This rule detects the KongTuke second-stage PowerShell loader. It specifically looks for PowerShell scripts that attempt to read a payload from a file named 'Remove-NetNatStaticMapping.log', decrypt it using DPAPI (Data Protection API) via 'ProtectedData]::Unprotect' and 'DataProtectionScope]::Localmachine', and then execute the decrypted content using an 'iex' alias. The script also includes references to 'Add-Type -AssemblyName System.Security' and 'AppActions', indicating advanced PowerShell capabilities and potential interaction with application-related data. The use of 'ReadAllBytes' and 'UTF8.GetString' suggests the payload is read as raw bytes and then converted to a string for execution.
This rule detects suspicious activity related to browser credential theft or staging. It triggers when a non-browser process accesses sensitive browser files (like 'Login Data' or 'Local State') or when temporary artifacts associated with credential stealer activity ('chromeTmp', 'Local State-journal') are created. This behavior is indicative of an attacker attempting to exfiltrate browser-stored credentials.
Detects the use of GDB (GNU Debugger) to dump the memory of a running process. This technique is used by frameworks like ShadowHS to extract credentials and other secrets from live processes without writing traditional credential dumping tools to disk.
Detects activity associated with the Hannibal Stealer, a .NET info-stealer known for targeting cryptocurrency wallets, VPN configurations, and browser data.
Detects potential execution of BQTLock ransomware by identifying characteristic command-line strings, credential staging files, and associated UAC bypass techniques.
SesameOP Uses OpenAI Assistants API as a mechanism for command-and-control (C2) communications. Instead of relying on more traditional methods, the threat actor behind this backdoor abuses OpenAI as a C2 channel as a way to stealthily communicate and orchestrate malicious activities within the compromised environment. To do this, a component of the backdoor uses the OpenAI Assistants API as a storage or relay mechanism to fetch commands, which the malware then runs.
Detects the execution of TruffleHog, an open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment. This activity can indicate credential harvesting by threat actors. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.
The following analytic detects suspicious attempts to find credentials stored in password stores, indicating a potential attacker's effort to access sensitive login information. Password stores are critical repositories that contain valuable credentials, and unauthorized access to them can lead to significant security breaches. By monitoring for unusual or unauthorized activities related to password store access, this analytic helps identify potential credential theft attempts, allowing security teams to respond promptly and prevent unauthorized access to critical systems and data.
Detects a process accessing multiple sensitive files in WhatsApp or Google Chrome data folders, a technique used by Mysterious Elephant APT's exfiltration tools (Uplo, Stom, ChromeStealer).
Detects PhantomVAI Loader and its common payload, Katz Stealer. PhantomVAI is a .NET loader known for delivering various infostealers and uses VM detection techniques. Katz Stealer is an infostealer notable for its anti-CIS country checks to evade analysis.
Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment.
It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.
It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.
The following analytic detects a non-Chrome process accessing files in the Chrome user default folder. It leverages Windows Security Event logs, specifically event code 4663, to identify unauthorized access attempts. This activity is significant because the Chrome default folder contains sensitive user data such as login credentials, browsing history, and cookies. If confirmed malicious, this behavior could indicate an attempt to exfiltrate sensitive information, often associated with RATs, trojans, and advanced persistent threats like FIN7. Such access could lead to data theft and further compromise of the affected system.
Detects the execution of LaZagne, a utility used to retrieve multiple types of passwords stored on a local computer. LaZagne has been leveraged by threat actors to dump credentials.
Detects scenarios where an attacker attempt to dump Azure Active Directory Connect credentials via network share.
Detects scenarios where an attacker attempt to dump browser credentials (Firefox, Google Chrome, ...) via network share.
Detects scenarios where an attacker attempt to dump application credentials (Firefox, VNC, Google Chrome, ...) via network share.
Page 14 of 17