Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
711 detections
Filters
Last updated
All Time
Detection languages
340
114
58
50
47
Contributors
244
152
92
68
16
Categories
569
437
138
95
76
Platforms
645
90
61
10
10
Products / Services
275
214
30
28
25
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
711
CVEs
9
1
1
IDS Classtypes
9
IDS Protocols
8
1
Detects unauthorized processes, such as TaskWeaver implants or scripts (node.exe, wscript.exe, cscript.exe) running from non-standard directories (e.g., %TEMP%, %APPDATA%), attempting to access web browser credential databases. This behavior is indicative of post-exploitation credential harvesting, specifically linked to Djinn Stealer activity following CVE-2026-48558 exploits.
Detects the creation of a 'BackupFiles' directory and the subsequent copying of sensitive browser artifacts (e.g., Login Data, Web Data, Local Storage) within Chrome or Edge user data paths. This activity is indicative of credential and session theft staging, specifically associated with the ToddyCat group's Umbrij malware preparation for browser exploitation.
This rule detects various methods used to extract credentials protected by the Windows Data Protection API (DPAPI). It covers multiple vectors, including Mimikatz DPAPI module usage, unauthorized loading of the dpapi.dll library, suspicious access to browser or WiFi credential stores, and cross-process memory access to the LSASS process to extract DPAPI master keys.
Detects unauthorized processes attempting to access sensitive browser files such as 'Login Data', 'Cookies', and 'Web Data' files typically located in Chrome or Firefox user profiles. This behavior is indicative of credential theft or data exfiltration, as these files contain saved usernames, passwords, and session cookies.
Detects unauthorized access to browser credential databases, cloud configuration files, and developer secret stores by processes spawned from Node.js or npm. This behavior is indicative of IronWorm and similar infostealers exploiting malicious npm package preinstall hooks to harvest sensitive developer credentials.
Detects the node.exe process (npm lifecycle) accessing sensitive web browser credential databases (e.g., Login Data, Cookies, Web Data, and Firefox profiles). This activity is indicative of infostealer malware, such as Miasma or MYRA, which often leverages malicious npm packages to drop and execute SQLite-based credential exfiltration logic directly from disk.
Detects anomalous network activity from browser renderer subprocesses (chrome.exe/msedge.exe) correlated with concurrent file system access to sensitive browser credential stores (Login Data/Cookies). The rule identifies high-frequency outbound connections following or occurring during access to these files, which is a common indicator of credential exfiltration performed by malicious browser extensions or injected scripts.
Detects attempts by a Chrome web browser process to create, modify, or rename files associated with sensitive user credentials or application data, such as AWS credentials, browser logins, or environment configuration files. This behavior is indicative of credential theft or staging of sensitive information.
This rule detects unauthorized attempts to create, modify, rename, or delete sensitive browser data files (such as Login Data, Cookies, key4.db, and logins.json) used for storing credentials. It monitors for access by processes that are not known browser executables or authorized system services, which is a common indicator of credential dumping by malicious software.
This rule detects unauthorized attempts by non-browser processes to access sensitive browser-related files (Login Data, Cookies, Web Data, etc.) or interact with browser processes to extract secrets. It monitors for Sysmon Event IDs 10 (ProcessAccess), 11 (FileCreate), 7 (ImageLoad), and 1 (ProcessCreate) where a suspicious process (often located in temporary or user profile directories) attempts to read or interact with known browser credential storage paths.
Detects instances of a Node.js process accessing sensitive browser credential and cookie storage files, which is a common behavior associated with credential theft malware or malicious scripts.
This rule detects potential unauthorized access to web browser data files (such as logins, cookies, and history databases) or specific registry modifications indicative of browser hijacking or credential theft. It monitors for processes other than known web browsers accessing sensitive browser configuration files or creating registry keys in HKCU that might be used for persistence or browser configuration manipulation.
Detects multiple processes accessing sensitive browser data files like 'Local State' and 'Login Data', commonly associated with credential theft activities from web browsers.
Detects behavior indicative of the Vidar information stealer, specifically the mass access of web browser credential stores (Login Data, Cookies) followed by the execution of archive utilities (7z, rar, WinRAR) to stage stolen data for exfiltration.
Detects unauthorized processes attempting to access sensitive browser credential files (Login Data and Cookies) for Chrome, Edge, and Firefox. The rule applies risk scoring based on whether the accessing process is located in suspicious directories (e.g., Temp, Downloads) or if specific indicators associated with the Millenium RAT are present.
Detects unauthorized file access to common developer credential storage locations on Linux workstations, including SSH keys, cloud provider configuration files, and browser session artifacts. This behavior is associated with the InvisibleFerret payload used in the Lazarus Contagious Interview campaign to exfiltrate identity and access tokens from developer machines.
Detects Meow RAT (ClickFix campaign) copying Chromium browser extension data directories associated with cryptocurrency wallets, including MetaMask (nkbihfbeogaeaoehlefnkodbefgpgknn), via osascript on macOS.
This rule monitors for unauthorized access to the Google Chrome 'Login Data' database file by processes other than standard browser executables. It also detects the creation of known file artifacts associated with credential-stealing malware or RATs (e.g., 'chrome_logins_dump.txt' or 'gather.tar.gz'), which are indicative of credential harvesting activities.
This rule detects activities associated with the MiniBrowse tool, specifically targeting unauthorized access to browser credential stores (Login Data, Cookies) and staging files for exfiltration. Additionally, it monitors for process injection events where MiniBrowse components are injected into legitimate browser processes such as Chrome or Edge.
Detects Python interpreters (or processes executing from PyInstaller-generated temporary directories) accessing sensitive web browser files such as Login Data, Cookies, or Local State. This activity is commonly associated with information stealer malware, such as Glove Stealer, attempting to extract saved credentials from browsers.
Detects non-browser processes attempting to read, create, or modify browser-specific credential storage files (e.g., 'Login Data', 'logins.json', 'signons.sqlite') associated with Chromium-based browsers or Firefox. This activity is a common indicator of credential theft by malware such as Atlas RAT or ValleyRAT.
Page 21 of 34