Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
339 detections
Filters
Last updated
All Time
Detection languages
120
95
28
25
18
Contributors
111
38
29
22
22
Categories
227
127
107
45
27
Platforms
254
58
57
11
10
Products / Services
76
70
29
21
17
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
2
2
1
1
1
IDS Classtypes
7
1
IDS Protocols
8
Detects instances where a process other than the authorized password manager application (e.g., 1Password, Bitwarden, KeePass) attempts to create, modify, rename, or read sensitive database files associated with these password managers. This behavior may indicate an attempt to exfiltrate or compromise stored credentials.
Detects suspicious execution of tools or command lines associated with DPAPI domain backup key extraction, including mimikatz, SharpDPAPI, lsadump::backupkeys, and related backupkey commands. This behavior may indicate an attempt to obtain the domain DPAPI backup key from a Domain Controller, enabling decryption of DPAPI-protected secrets across the domain.
Detects access to the Windows DPAPI master key storage directory located at '\Microsoft\Protect\' by processes other than standard system components (lsass.exe, svchost.exe, dllhost.exe). Accessing these files is a common technique used by adversaries to decrypt sensitive credentials stored on the system.
Detects access to the Windows DPAPI master key storage directory located at '\Microsoft\Protect\' by processes other than standard system components (lsass.exe, svchost.exe, dllhost.exe). Accessing these files is a common technique used by adversaries to decrypt sensitive credentials stored on the system.
Detects NirSoft-based credential harvesting toolkit binaries staged in user profile path csidl_profile\music\mimik\pass\, used to extract browser, VNC, email, Wi-Fi, and Credential Manager secrets
This rule detects file creation, renaming, or modification events targeting files associated with cryptocurrency wallets, such as wallet.dat or files containing the string 'keystore'. Accessing these files is a common technique used by malware or malicious actors to steal cryptocurrency credentials and private keys.
Detects file access events targeting sensitive browser files, specifically 'passwords.json' and 'cookies.json', located within the standard Chrome/browser application data directories. These files often contain stored credentials and session cookies, and unauthorized access is a common precursor to credential theft.
This rule detects processes attempting to access known cryptocurrency wallet data files. These files, such as 'wallet.dat' or 'wallet.json', are high-value targets for attackers seeking to exfiltrate cryptographic assets. The rule excludes common, legitimate cryptocurrency wallet applications that are expected to access these specific files.
This rule detects the execution of known NirSoft credential recovery utilities, such as WebBrowserPassView, ChromePass, and others, when they are located within a specific 'music/mimik/' directory structure, which is indicative of credential harvesting activities staged by an adversary.
This rule detects the execution of processes named 'MiniBrowse' or access attempts to common web browser credential storage files (Google Chrome 'Login Data', Microsoft Edge 'Login Data', and Mozilla Firefox 'logins.json' or 'key4.db'). These patterns are characteristic of browser credential stealing malware or unauthorized data collection tools.
This rule monitors for a suspicious execution pattern where a browser (Chrome or Edge) is launched with specific command-line flags ('--no-first-run', '--disable-gpu', 'about:blank') by a non-standard parent process, followed shortly by the loading of the 'elevation_service.exe' from 'services.exe' and the loading of 'DPAPI.dll' by the browser process. This sequence is often associated with automated browser credential dumping activities, where attackers attempt to bypass UI requirements or programmatically extract secrets from the browser's credential storage.
Detects the use of the 'security' command-line utility to interact with the 'login.keychain-db' file on macOS, which is a common technique used by adversaries to dump credentials.
Detects the EKZ Stealer malware masquerading as a legitimate Fortinet update process (FortiEndpoint_Patch.exe). The rule monitors for the execution of this specific filename or hash, identifies suspicious command-line arguments (list, search, view, label, export) indicating credential theft activities, and alerts on the creation of the binary and subsequent log files within the ProgramData directory.
This rule detects potential credential harvesting and sensitive data collection activities on macOS by monitoring for access to keychain databases, browser data files (cookies, logins), and shell history files. It looks for both direct file access and the use of the 'security' utility to dump keychain information.
Detects Node.js processes attempting to access sensitive files or environment variables associated with Claude AI (e.g., Anthropic API keys, .claude configuration files), which may indicate credential harvesting activity by malicious code.
Detects unauthorized processes, such as PyInstaller binaries or Python scripts, attempting to read LevelDB storage files used by popular messaging applications (Discord, Telegram, Signal, Slack, and Microsoft Teams) for session and authentication token extraction, a technique commonly associated with information stealers like Yuta or Glove Stealer.
Detects instances where non-browser or system maintenance processes attempt to access browser credential storage files, such as 'Login Data', 'key4.db', or 'logins.json'. The rule uses a self-join to correlate access to these sensitive files with access to the Windows DPAPI protection directories, often used to decrypt these credentials.
Detects Node.js processes accessing sensitive configuration and credential files such as AWS credentials, .npmrc tokens, SSH keys, and Docker configurations. This behavior is consistent with infostealer activity, including malicious supply chain attacks designed to harvest developer secrets from local filesystems.
Detects suspicious child processes spawned by AI-powered IDE assistants (e.g., Amazon Q, Claude Code, Cursor) that perform AWS credential inspection combined with network exfiltration commands. This activity is indicative of exploitation of IDE extension vulnerabilities (e.g., CVE-2026-12957) where malicious configuration files force the IDE to spawn shell processes to steal and transmit cloud environment credentials.
Detects suspicious execution of Python or shell scripts (bash, zsh, sh) from paths associated with 'openclaw' or 'clawhub' that are interacting with sensitive data files, including browser credential stores (Chrome, Firefox, Edge, Brave), system keychains, and cryptocurrency wallet files.
Detects anomalous credential access behavior in Azure Key Vault where a single identity performs more than 20 secret, key, or certificate read/list operations within a 5-minute window. This behavior is indicative of potential unauthorized reconnaissance or exfiltration of secrets stored in Key Vaults, excluding known automation service principals.
Page 7 of 17