Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
711 detections
Filters
Last updated
All Time
Detection languages
340
114
58
50
47
Contributors
244
152
92
68
16
Categories
569
437
138
95
76
Platforms
645
90
61
10
10
Products / Services
275
214
30
28
25
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
711
CVEs
9
1
1
IDS Classtypes
9
IDS Protocols
8
1
Detects credential harvesting behavior associated with the BQTLock (BaqiyatLock) malware, including the staging of password files in temporary directories, unauthorized access to browser credential stores (e.g., Login Data, key4.db), and the use of system utilities like vaultcmd.exe to interact with the Windows Credential Manager. It also monitors the execution of PyInstaller-packed loaders (BQT.exe or start.exe) from temporary directories.
This rule detects processes other than standard web browsers (Chrome, Edge, Brave) attempting to access sensitive directories within Chrome extension user data paths, such as IndexedDB, Local Storage, or Sync Data. Such activity is often indicative of credential or session cookie theft by malicious scripts or malware.
Detects malicious activity associated with the Miasma/MYRA infostealer campaign targeting DeFi developers. The rule monitors npm lifecycle scripts (postinstall/preinstall) for suspicious execution, C2 communication with known malicious domains, unauthorized access to browser-based credential storage, and persistence attempts via LD_PRELOAD on Linux environments.
This rule detects when processes other than standard web browsers (Chrome, Edge, Firefox, Brave, Opera) attempt to read sensitive browser data files such as 'Login Data', 'Cookies', or 'Web Data'. These files contain stored credentials and session information, and unauthorized access is a common technique used by credential-stealing malware to exfiltrate sensitive user information.
This rule detects when a Node.js or NPM process accesses multiple sensitive browser credential files (Login Data or Cookies) within a short window, while simultaneously reading shell history files (bash_history, zsh_history, or fish_history). This behavior is characteristic of an automated credential harvester or infostealer script executing within a Node.js environment.
Detects Node.js processes accessing paths associated with cryptocurrency wallets and browser extension storage (MetaMask, Phantom, Exodus, Electrum). This behavior is characteristic of infostealer malware attempting to exfiltrate seed phrases, keys, or wallet configuration data.
This rule detects potential unauthorized access to web browser data files (such as Login Data, Cookies, or History) by processes other than the legitimate browser applications. It also identifies process command-line arguments often used by malicious tools to access browser data or bypass protections, which is a common indicator of credential theft from browsers.
This rule monitors for file system operations (creation, modification, deletion, or renaming) performed by a Node.js process when interacting with sensitive directories and files associated with web browser extensions and cryptocurrency wallets. This pattern is commonly observed in credential and private key theft activities where malicious scripts attempt to exfiltrate wallet data.
This rule detects when processes other than standard web browsers (Firefox, Chrome, Edge, IE) delete sensitive browser files such as 'cookies.sqlite', 'logins.json', 'Login Data', or 'Cookies'. This behavior is indicative of credential wiping or anti-forensics activity by malware, such as the Remcos RAT, attempting to clear evidence of browser activity.
Detects node.exe or npm processes accessing directory paths associated with popular browser cryptocurrency wallet extensions, a behavior indicative of the Miasma infostealer used in supply chain attacks.
Detects unauthorized processes attempting to access sensitive local browser files (credential stores, cookies, and local state databases) associated with Chrome, Edge, Brave, Chromium, and Firefox. Such access is a primary indicator of infostealer malware attempting to harvest saved credentials and session cookies from a victim's machine.
Detects unauthorized access to sensitive browser credential files (Login Data, Cookies, logins.json) by processes other than standard browsers or known security products. This activity is a common indicator of credential harvesting by infostealer malware families aiming to compromise saved passwords and session cookies.
Detects unauthorized processes attempting to access sensitive browser credential stores, such as Login Data, Cookies, or Local State, typically targeted by the Millenium RAT (DotStealer component) to harvest credentials and bypass Chromium App-Bound encryption.
Detects unauthorized processes reading or opening files located within the data directories of Discord or Telegram Desktop. These directories often store sensitive user data, including session tokens and local databases, which are common targets for info-stealing malware.
Detects non-browser processes (e.g., non-standard executables) attempting to read sensitive browser data files, specifically Login Data, Cookies, or Firefox profile data. This behavior is highly characteristic of credential-stealing malware or unauthorized data exfiltration tools accessing browser-stored secrets.
Detects unauthorized non-browser processes attempting to access sensitive credential and session cookie files associated with major web browsers such as Chrome, Edge, and Firefox. This behavior is indicative of credential harvesting techniques often utilized by infostealer malware, including variants of the Millenium RAT, to extract stored passwords and session tokens.
Detects attempts by unsigned processes to read or modify sensitive web browser credential files (Login Data or logins.json) typically used by Google Chrome, Microsoft Edge, and Mozilla Firefox. This behavior is indicative of credential dumping or information stealing activities by unauthorized or malicious software.
Detects the CastleLoader Python process rapidly scraping Chromium SQLite databases (Login Data, Cookies) to steal stored credentials and session cookies. The rule identifies Python processes accessing multiple browser credential/session databases within a one-minute window.
Detects unauthorized processes (Python, Node.js) accessing sensitive files such as browser login data, cookie stores, wallet files, and SSH/AWS keys, which are common indicators of credential theft and data exfiltration.
Detects Python processes (potentially associated with the ChocoPoC RAT, slogsec, or logcrypt modules) performing file read or access operations against common browser credential store files such as Login Data, Cookies, and Web Data on Windows and macOS systems.
This rule detects attempts by common scripting or utility processes (like osascript, curl, zsh, bash, sh, python) to access sensitive macOS files, specifically targeting browser data (Chrome, Brave, Firefox) and keychain files. This activity could indicate an attacker attempting to exfiltrate credentials, session tokens, or other sensitive user data.
Page 22 of 34