Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
711 detections
Filters
Last updated
All Time
Detection languages
340
114
58
50
47
Contributors
244
152
92
68
16
Categories
569
437
138
95
76
Platforms
645
90
61
10
10
Products / Services
275
214
30
28
25
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
711
CVEs
9
1
1
IDS Classtypes
9
IDS Protocols
8
1
Detects attempts by non-browser processes to access sensitive Chromium-based browser files including Login Data, Cookies, and Web Data. This behavior is indicative of credential dumping or session cookie theft where unauthorized software attempts to extract browser-stored secrets.
Detects the CylindricalCanine/GoldenEyeDog credential-theft pattern where the malware first kills a running browser or chat client (Chrome.exe, firefox.exe, skype.exe, 360se.exe, 360chrome.exe, QQBrowser.exe) and then, within a short window, reads/creates the associated credential/profile files (Login Data, avBackup.dat, FormData3.dat, historyUrl3.db, history3.db) on the same device.
Detects the JC-46 AsyncRAT technique chain where the malware opens winlogon.exe's process token, duplicates it into an impersonation token, calls ImpersonateLoggedOnUser, enables SE_DEBUG_NAME via AdjustTokenPrivileges to reach SYSTEM context, then uses CNG (NCryptOpenStorageProvider/NCryptOpenKey/NCryptDecrypt) and BCrypt AES-GCM (BCryptOpenAlgorithmProvider) APIs to unwrap Chromium v96+ App-Bound Encryption keys.
Detects unauthorized file access attempts targeting sensitive data directories such as Telegram tdata, web browser credential stores (Login Data, Cookies), cryptocurrency wallet configuration folders (Exodus, Electrum), and Foxmail data files. This rule filters out legitimate access by the corresponding applications themselves to reduce noise.
Detects attempts by non-browser processes to access sensitive Chromium-based browser files including Login Data, Cookies, and Web Data. This behavior is indicative of credential dumping or session cookie theft where unauthorized software attempts to extract browser-stored secrets.
Detects the JC-46 AsyncRAT technique chain where the malware opens winlogon.exe's process token, duplicates it into an impersonation token, calls ImpersonateLoggedOnUser, enables SE_DEBUG_NAME via AdjustTokenPrivileges to reach SYSTEM context, then uses CNG (NCryptOpenStorageProvider/NCryptOpenKey/NCryptDecrypt) and BCrypt AES-GCM (BCryptOpenAlgorithmProvider) APIs to unwrap Chromium v96+ App-Bound Encryption keys.
Detects the JC-46 AsyncRAT technique chain where the malware opens winlogon.exe's process token, duplicates it into an impersonation token, calls ImpersonateLoggedOnUser, enables SE_DEBUG_NAME via AdjustTokenPrivileges to reach SYSTEM context, then uses CNG (NCryptOpenStorageProvider/NCryptOpenKey/NCryptDecrypt) and BCrypt AES-GCM (BCryptOpenAlgorithmProvider) APIs to unwrap Chromium v96+ App-Bound Encryption keys.
Detects unauthorized processes attempting to access sensitive credential database files (Login Data, key4.db, logins.json) used by Chromium-based browsers or Mozilla Firefox. This behavior is indicative of credential theft attempts, where malicious actors seek to extract saved passwords and cookies from the browser's local storage.
Detects unauthorized processes attempting to access sensitive credential database files (Login Data, key4.db, logins.json) used by Chromium-based browsers or Mozilla Firefox. This behavior is indicative of credential theft attempts, where malicious actors seek to extract saved passwords and cookies from the browser's local storage.
Detects processes attempting to read sensitive browser storage files, specifically 'Login Data' (passwords) and 'Cookies', located within common browser paths for Chrome, Firefox, and Safari on macOS or similar environments using Application Support/Library folders.
Detects instances where runas.exe is used to launch PowerShell and monitors subsequent child processes for suspicious commands or activity, such as credential dumping tools, encoded commands, or access to sensitive browser data locations, which may indicate credential theft or unauthorized lateral movement.
Detects unauthorized processes attempting to access sensitive credential database files (Login Data, key4.db, logins.json) used by Chromium-based browsers or Mozilla Firefox. This behavior is indicative of credential theft attempts, where malicious actors seek to extract saved passwords and cookies from the browser's local storage.
This rule detects processes attempting to open or read files commonly associated with cryptocurrency wallets (Exodus, Electrum, MetaMask) on the endpoint. Unauthorized access to these files is a common indicator of credential theft or attempts to compromise wallet data.
This rule detects when common Windows LOLBins (Living-off-the-Land Binaries) or scripting hosts attempt to read, create, modify, or rename sensitive credential storage files (such as login databases and cookies) associated with popular web browsers like Chrome, Edge, and Firefox. Such behavior is a common indicator of credential theft activity by information-stealing malware.
Detects instances where browser-related credential files (Login Data, Cookies, cookies.sqlite) are accessed by processes that are not the associated web browsers. This behavior is indicative of credential theft or dumping, where unauthorized processes attempt to read sensitive browser data to extract stored credentials, cookies, or session tokens.
Detects the execution chain associated with the CrySome RAT, which terminates common web browsers (Chrome, Edge, Brave), drops a malicious DLL ('abe_decrypt.dll') into a temporary directory, and subsequently restarts the browser to facilitate credential theft.
This rule detects potential information stealing activity by identifying either known StealC payload hashes or unauthorized processes spawned by PowerShell accessing web browser credential files (e.g., Login Data, Cookies, Local State). This is often associated with ClickFix or similar delivery mechanisms where an attacker uses PowerShell to stage sensitive browser data for exfiltration.
This rule detects unauthorized read, creation, modification, or renaming activity involving sensitive browser files (Login Data, Cookies, Web Data) on macOS. Adversaries often target these files to extract saved credentials, cookies for session hijacking, or browsing history.
Detects instances where processes other than common web browsers (e.g., Chrome, Edge, Firefox) access sensitive browser data files (such as login data, cookies, or history) located in standard browser profile directories. This behavior is indicative of credential dumping or unauthorized data collection from local web browser storage.
Detects access, creation, or modification of sensitive browser files (Cookies, Login Data, Local State) associated with Google Chrome or Microsoft Edge. The rule specifically flags when these files are interacted with within standard user directories or when they are copied to known browser backup folders, a common behavior during credential theft or data staging.
Detects Python scripts or processes accessing browser 'Local State' files and subsequently invoking decryption routines like DPAPI's CryptUnprotectData or NSS's PK11SDR_Decrypt. This behavior is indicative of credential theft activity where malware, such as BusySnake Stealer, attempts to decrypt stored browser credentials for exfiltration.
Page 18 of 34