Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
711 detections
Filters
Last updated
All Time
Detection languages
340
114
58
50
47
Contributors
244
152
92
68
16
Categories
569
437
138
95
76
Platforms
645
90
61
10
10
Products / Services
275
214
30
28
25
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
711
CVEs
9
1
1
IDS Classtypes
9
IDS Protocols
8
1
Detects unauthorized processes attempting to read, modify, create, or rename browser sensitive data files such as 'Login Data' (passwords) and 'Cookies' for Google Chrome and Microsoft Edge. This activity is a common indicator of credential theft or session hijacking.
Detects instances where Chrome or Microsoft Edge web browsers access local sensitive credential storage files (e.g., Login Data, Web Data, Cookies) from unexpected file system paths, combined with external network traffic from the same process instance. This behavior is indicative of potential malicious browser extension abuse, DLL sideloading, or unauthorized browser instance execution for credential exfiltration.
Detects the creation or connection to a named pipe containing the string 'ChromeAppBoundVIP', a behavior associated with the WEES stealer malware for extracting sensitive information from web browsers.
Detects unauthorized processes, such as PyInstaller binaries or Python scripts, attempting to read LevelDB storage files used by popular messaging applications (Discord, Telegram, Signal, Slack, and Microsoft Teams) for session and authentication token extraction, a technique commonly associated with information stealers like Yuta or Glove Stealer.
Detects instances where non-browser or system maintenance processes attempt to access browser credential storage files, such as 'Login Data', 'key4.db', or 'logins.json'. The rule uses a self-join to correlate access to these sensitive files with access to the Windows DPAPI protection directories, often used to decrypt these credentials.
Detects suspicious execution of Python or shell scripts (bash, zsh, sh) from paths associated with 'openclaw' or 'clawhub' that are interacting with sensitive data files, including browser credential stores (Chrome, Firefox, Edge, Brave), system keychains, and cryptocurrency wallet files.
Detects unauthorized access attempts to sensitive Chromium and Mozilla browser credential databases (e.g., Login Data, Cookies, Web Data, logins.json) by non-browser processes. This behavior is a common indicator of infostealer malware seeking to exfiltrate stored credentials for later decryption and abuse.
Detects the EKZ Stealer malware (masquerading as 'FortiEndpoint_Patch.exe') attempting to access sensitive web browser files ('Login Data' and 'Local State') used to store credentials, and subsequently writing stolen information to 'C:\ProgramData\log.txt'.
This rule detects non-Mozilla processes that systematically access sensitive Firefox browser files such as logins.json, key3.db, key4.db, and cookies.sqlite. Repeated access by processes not associated with the Mozilla Corporation or the Firefox browser suite is indicative of credential harvesting attempts by malicious software.
Detects unauthorized processes (Node.js or Python) attempting to read sensitive browser credential files or access browser profile directories, often indicative of credential theft malware such as BeaverTail or InvisibleFerret.
Detects unauthorized non-browser processes accessing Chrome Local State, Cookies, or Login Data files. This activity is indicative of credential harvesting by infostealers, such as the Glove Stealer/Yuta campaign, attempting to bypass App-Bound Encryption (ABE) by accessing browser configuration and data stores.
Detects attempts by a Chrome web browser process to create, modify, or rename files associated with sensitive user credentials or application data, such as AWS credentials, browser logins, or environment configuration files. This behavior is indicative of credential theft or staging of sensitive information.
Detects non-browser processes attempting to read or delete sensitive browser data files (e.g., Login Data, Cookies, Web Data, logins.json, cookies.sqlite) located in standard Windows browser paths. The rule specifically flags suspicious behavior involving file access and deletion patterns commonly associated with credential theft or 'browser-wiping' malware like Remcos.
Detects instances where browser processes (msedge.exe, chrome.exe) copy sensitive credential and session SQLite databases (e.g., Login Data, Cookies) to locations outside of the canonical User Data directories. This behavior is indicative of the StegoAd campaign, where malicious browser extensions stage these files for subsequent exfiltration.
This rule detects potential credential theft from web browsers (Edge/Chrome) by monitoring access to the 'Login Data' SQLite database file. It correlates file access events with subsequent outbound HTTPS connections to non-Microsoft and non-Google domains initiated by the same browser process within a 10-minute window, which is indicative of exfiltration of stolen browser credentials.
Detects unauthorized access to browser-based credential storage files (such as Login Data and cookies) by processes other than recognized browser executables. This behavior is indicative of credential theft or dumping attempts, often performed by malicious software to exfiltrate saved passwords and session cookies.
Detects two distinct suspicious patterns indicative of OAuth consent abuse and browser-based credential theft. The first pattern identifies non-Microsoft script interpreters or binaries initiating network connections to Microsoft's OAuth endpoints. The second pattern identifies unauthorized processes attempting to access or modify sensitive browser data files (e.g., 'Login Data', 'Cookies') which are typically reserved for browser-specific processes.
Detects unauthorized processes attempting to read sensitive browser credential files (Login Data, Cookies, Web Data) from Chrome, Edge, and similar browsers, which is a common post-compromise technique used by infostealer malware to exfiltrate session cookies and stored credentials.
Detects Python processes spawned from development tools (Node.js, VS Code, Cursor) that perform suspicious file access to browser credential stores (e.g., Login Data, cookies.sqlite) and subsequently initiate significant outbound network POST requests, characteristic of browser-based credential harvesting and exfiltration.
Detects suspicious activities originating from SimpleHelp remote support processes, including the spawning of unauthorized child processes, execution of potentially malicious JavaScript loaders (e.g., TaskWeaver-related), and access to sensitive browser-based credential or configuration files often targeted by infostealers like Djinn Stealer.
Detects evidence of Djinn Stealer malware activity, including unauthorized access to web browser credential stores, suspicious child process creation by the SimpleHelp RMM daemon, and network communication with a known command-and-control server (96.126.130.126:58942) using a specific telemetry client user agent.
Page 20 of 34