Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
711 detections
Filters
Last updated
All Time
Detection languages
340
114
58
50
47
Contributors
244
152
92
68
16
Categories
569
437
138
95
76
Platforms
645
90
61
10
10
Products / Services
275
214
30
28
25
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
711
CVEs
9
1
1
IDS Classtypes
9
IDS Protocols
8
1
Detects malicious browser extension activity related to the StegoAd infostealer. The rule identifies a dual-indicator pattern consisting of outbound network connections to 'mitarchive.info' combined with concurrent read access to browser-specific credential store files (Google Chrome, Microsoft Edge, Mozilla Firefox) on the same host.
Detects unauthorized processes (those not identified as standard web browsers) accessing browser profile directories (Local Storage or IndexedDB) associated with major AI platforms such as OpenAI, ChatGPT, Anthropic, and Copilot. This behavior is indicative of credential theft or session token exfiltration from local browser storage.
Detects unauthorized processes accessing sensitive Google Chrome credential files (Login Data and Cookies) typically stored in the AppData local folder. This behavior is characteristic of information stealers and trojans like ModeloRAT, Backdoor.Mistic, StealC, and Amadey, which attempt to exfiltrate stored browser passwords and session cookies.
This rule detects when processes other than known web browsers (Chrome, Firefox, Edge, Opera) attempt to access sensitive browser-related files such as 'Login Data', 'Cookies', and database files. It specifically flags instances where the accessing process or its parent process originates from 'C:\ProgramData' or where the parent process is 'powershell.exe', which is a common pattern for malicious credential access tools.
Detects unauthorized processes attempting to access sensitive browser files such as 'Login Data', 'Cookies', or 'Web Data' in Google Chrome, Microsoft Edge, or Brave. These files contain stored credentials and session information that are frequent targets for credential theft malware and post-exploitation activity.
Detects unauthorized processes attempting to access sensitive browser files such as 'Login Data', 'Cookies', or 'Web Data' in Google Chrome, Microsoft Edge, or Brave. These files contain stored credentials and session information that are frequent targets for credential theft malware and post-exploitation activity.
Detects activity associated with the Lightlife RAT, which involves PowerShell scripts accessing cryptocurrency wallet browser extension directories, staging data using archive utilities, and exfiltrating collected data to external destinations like the Telegram Bot API.
Detects the unauthorized access of sensitive files (browser data, SSH keys, AWS credentials) followed by the creation of archives using common utilities (7zip, tar, zip) by processes spawned within npm/node.exe/powershell/wscript/chost.exe postinstall execution chains. This behavior is associated with credential theft and data staging for exfiltration, notably seen in campaigns like Operation Friday Harvest.
Detects unauthorized processes attempting to access sensitive browser files such as Login Data, Cookies, or Web Data for Google Chrome or Microsoft Edge. This activity is indicative of credential theft, where malicious actors attempt to extract stored passwords or session cookies from web browsers.
This rule monitors for file access events (Sysmon Event ID 11) targeting sensitive web browser files, including logins (passwords), cookies, and web data, by processes other than the legitimate browser executables. Such access is a strong indicator of credential theft or session hijacking attempts.
This rule monitors for file access events (Sysmon Event ID 11) targeting sensitive web browser files, including logins (passwords), cookies, and web data, by processes other than the legitimate browser executables. Such access is a strong indicator of credential theft or session hijacking attempts.
Detects unauthorized processes attempting to access browser-stored credential files (Chrome, Edge, and Firefox) such as 'Login Data', 'Cookies', 'Local State', and 'logins.json'. The rule filters known browser processes and common password manager applications to reduce noise from legitimate software that manages or accesses these files.
Detects instances where a non-standard browser process accesses sensitive browser credential files (e.g., Login Data, Cookies, key4.db) and simultaneously establishes a network connection to Discord or transmits data to a Discord webhook. This pattern is consistent with infostealer malware attempting to exfiltrate cached credentials via external services.
Detects unauthorized access to sensitive developer credential files and browser credential stores, typical of the IronWorm Rust-based infostealer. The rule monitors processes that are not known developer or browser tools as they read paths associated with AWS, SSH, Kubernetes, Docker, browser login data, and cryptocurrency wallets.
Detects instances where a Node.js process accesses, modifies, or creates files within web browser extension directories. This behavior is indicative of unauthorized access to sensitive browser data, such as extension configurations, authentication tokens, or stored secrets.
This rule detects processes other than standard web browsers (Chrome, Edge, Brave) attempting to access sensitive directories within Chrome extension user data paths, such as IndexedDB, Local Storage, or Sync Data. Such activity is often indicative of credential or session cookie theft by malicious scripts or malware.
Detects instances where a node.exe process accesses files located within directories associated with popular browser-based cryptocurrency wallets. This pattern is commonly observed in infostealer malware campaigns that target wallet seeds, keys, and browser credentials stored in extension local storage or browser profile paths.
Detects unauthorized access or modification attempts to cryptocurrency wallet files (specifically MetaMask and Phantom browser extensions) by non-browser processes. This behavior is indicative of credential theft or wallet exfiltration by malicious software.
Detects instances where JavaScript runtime processes (node, npm) execute specific peer-related or verification scripts and subsequently access sensitive system files or directories, such as SSH configurations, AWS credentials, or browser data, within a 5-minute window.
This rule detects when processes other than standard web browsers (Chrome, Edge, Firefox, Brave, Opera) attempt to read sensitive browser data files such as 'Login Data', 'Cookies', or 'Web Data'. These files contain stored credentials and session information, and unauthorized access is a common technique used by credential-stealing malware to exfiltrate sensitive user information.
Detects unauthorized file operations (Creation, Modification, Rename, Deletion) on sensitive browser-related credential files (e.g., Login Data, Cookies, key4.db) by potentially unauthorized or suspicious processes identified by name.
Page 23 of 34