Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
711 detections
Filters
Last updated
All Time
Detection languages
340
114
58
50
47
Contributors
244
152
92
68
16
Categories
569
437
138
95
76
Platforms
645
90
61
10
10
Products / Services
275
214
30
28
25
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
711
CVEs
9
1
1
IDS Classtypes
9
IDS Protocols
8
1
MacSync Stealer (formerly known as Mac.c) is a macOS information stealer offered as a Malware-as-a-Service (MaaS). On May 5, 2026, researchers identified a new C2 domain (jacksonvillemma[.]com) delivering the malware's Stage 2 loader. Notably, this new infrastructure was active just days after the operator's previous C2 domain was publicly exposed, highlighting the threat actor's agility in rotating their delivery architecture.
Detects instances where 'ERAAgent.exe', part of the ESET Remote Administrator agent, loads the 'dpapi.dll' library from a location outside of standard Windows System directories (System32 or SysWOW64). Furthermore, the rule flags this behavior if the loaded 'dpapi.dll' file is either unsigned or contains an untrusted digital signature, which may indicate a malicious DLL side-loading or masquerading attempt to access protected system credentials.
Detects instances where 'ERAAgent.exe', part of the ESET Remote Administrator agent, loads the 'dpapi.dll' library from a location outside of standard Windows System directories (System32 or SysWOW64). Furthermore, the rule flags this behavior if the loaded 'dpapi.dll' file is either unsigned or contains an untrusted digital signature, which may indicate a malicious DLL side-loading or masquerading attempt to access protected system credentials.
Detects a non-browser process directly querying the Chrome/Brave/Edge SQLite Login Data store with the exact origin_url/username_value SELECT statements used by the botking RAT to harvest saved credentials.
Detects unauthorized processes accessing browser credential databases (e.g., 'Login Data') used by Google Chrome, Brave, and Microsoft Edge. This activity is a common indicator of credential theft by malicious software.
The following analytic detects non-Chrome processes accessing the Chrome "Local State" file, which contains critical settings and information. It leverages Windows Security Event logs, specifically event code 4663, to identify this behavior.
This activity is significant because threat actors can exploit this file to extract the encrypted master key used for decrypting saved passwords in Chrome.
If confirmed malicious, this could lead to unauthorized access to sensitive information, posing a severe security risk.
Monitoring this anomaly helps identify potential threats and safeguard browser-stored data.
This activity is significant because threat actors can exploit this file to extract the encrypted master key used for decrypting saved passwords in Chrome.
If confirmed malicious, this could lead to unauthorized access to sensitive information, posing a severe security risk.
Monitoring this anomaly helps identify potential threats and safeguard browser-stored data.
The following analytic detects a non-Chrome process accessing files in the Chrome user default folder. It leverages Windows Security Event logs, specifically event code 4663, to identify unauthorized access attempts. This activity is significant because the Chrome default folder contains sensitive user data such as login credentials, browsing history, and cookies. If confirmed malicious, this behavior could indicate an attempt to exfiltrate sensitive information, often associated with RATs, trojans, and advanced persistent threats like FIN7. Such access could lead to data theft and further compromise of the affected system.
Detects OptiDrive.exe sweeping multiple browser credential/cookie store files (Local State, Login Data, Cookies, History) across at least 3 distinct files within a 2-minute window, consistent with ACRStealer's browser credential harvesting.
Detects browser cookie theft via a cloned Chrome profile directory, CDP-based cookie export, and/or SQLite re-encryption of the cookie database using an attacker-known Safe Storage password, as used by AmnesiaStealer's streaming module.
Detects a concentrated sweep of multiple browser credential/cookie artifacts (Local State, Login Data, Cookies, History) by a single non-browser process (OptiDrive.exe) within a one-minute window — the ACRStealer credential-theft stage.
Detects process hollowing/injection into wab.exe, MSBuild.exe, dllhost.exe, or rundll32.exe — suspended process creation combined with SetThreadContext or NtQueueApcThread on the same process within a 5-minute window, followed by an outbound connection to known ACRStealer C2 (49.13.169.214) or renewed browser credential-store access.
Detects instances where 'ERAAgent.exe', part of the ESET Remote Administrator agent, loads the 'dpapi.dll' library from a location outside of standard Windows System directories (System32 or SysWOW64). Furthermore, the rule flags this behavior if the loaded 'dpapi.dll' file is either unsigned or contains an untrusted digital signature, which may indicate a malicious DLL side-loading or masquerading attempt to access protected system credentials.
The following analytic detects non-Chrome processes attempting to access the Chrome extensions file.
It leverages Windows Security Event logs, specifically event code 4663, to identify this behavior.
This activity is significant because adversaries may exploit this file to extract sensitive information from the Chrome browser, posing a security risk.
If confirmed malicious, this could lead to unauthorized access to stored credentials and other sensitive data, potentially compromising the security of the affected system and broader network.
It leverages Windows Security Event logs, specifically event code 4663, to identify this behavior.
This activity is significant because adversaries may exploit this file to extract sensitive information from the Chrome browser, posing a security risk.
If confirmed malicious, this could lead to unauthorized access to stored credentials and other sensitive data, potentially compromising the security of the affected system and broader network.
The following analytic identifies non-Chrome processes accessing the Chrome user data file "login data."
This file is an SQLite database containing sensitive information, including saved passwords.
The detection leverages Windows Security Event logs, specifically event code 4663, to monitor access attempts.
This activity is significant as it may indicate attempts by threat actors to extract and decrypt stored passwords, posing a risk to user credentials.
If confirmed malicious, attackers could gain unauthorized access to sensitive accounts and escalate their privileges within the environment.
This file is an SQLite database containing sensitive information, including saved passwords.
The detection leverages Windows Security Event logs, specifically event code 4663, to monitor access attempts.
This activity is significant as it may indicate attempts by threat actors to extract and decrypt stored passwords, posing a risk to user credentials.
If confirmed malicious, attackers could gain unauthorized access to sensitive accounts and escalate their privileges within the environment.
Detects rapid enumeration of browser extension storage (Local Extension Settings, IndexedDB) across multiple profiles by a non-browser process, matching AmnesiaStealer's generic cryptocurrency wallet-harvesting technique.
Detects CoolClient's data-collection module: co-occurring keylogging hook installation, clipboard access, and Chromium credential-store file access from an unsigned/non-OS-vendor process.
Detects an AutoIt3.exe/OptiDrive.exe process performing WMI sandbox-fingerprinting queries (Win32_DiskDrive, Win32_VideoController) followed within 15 minutes by access to browser credential files, consistent with ACRStealer's anti-analysis check preceding data collection.
Detects command-line activity indicating an attempt to extract generic passwords from Google Chrome or Brave browser credential storage, often associated with tools that access the 'Safe Storage' or similar password databases.
This is a two-part detection, with the first portion identifying injected-into processes by suspected malware, and the second portion identifying the previously identified injected process leveraging the DPAPI to decrypt stored secrets within a browser session. Results from this query will identify browser processes who had their encrypted credentials decrypted via DPAPI and read by the malicious process, highly indicative of stealer activity. Users should treat devices returned by this query as having their stored browser credentials compromised and rotate all saved passwords immediately.
This rule detects unauthorized or unexpected processes accessing sensitive browser data files, specifically 'Login Data' (password databases) and 'Cookies' files, located in standard macOS browser paths for Google Chrome and Firefox. By excluding legitimate browser and system update processes, the rule identifies potential credential dumping or session hijacking attempts.
Detects browser session-cookie database access followed by session reuse under impossible-travel or concurrent-session conditions, consistent with Gunra's VDI session-hijacking technique.
Page 15 of 34