Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
711 detections
Filters
Last updated
All Time
Detection languages
340
114
58
50
47
Contributors
244
152
92
68
16
Categories
569
437
138
95
76
Platforms
645
90
61
10
10
Products / Services
275
214
30
28
25
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
711
CVEs
9
1
1
IDS Classtypes
9
IDS Protocols
8
1
Detects unauthorized processes accessing browser credential databases (e.g., Login Data, Cookies, Web Data) associated with Chromium-based browsers on macOS. This behavior is indicative of credential harvesting often performed by infostealers like AMOS (Atomic macOS Stealer).
Detects unauthorized access to browser data and local credential stores initiated by the 'openclaw' or 'money-radar' malicious agent process trees. The rule monitors for file access events targeting sensitive credential files on Windows and macOS systems, which is characteristic of the ClawHub stealer malware.
Detects the Drun/Chromelevator infostealer bypassing Chrome App-Bound Encryption (introduced in Chrome 127) by spawning vt-windows-event-stream.exe to call Chrome's Elevation Service via COM and decrypt app_bound_encrypted_key from the Local State file. The rule looks for process creation of 'vt-windows-event-stream.exe', registry queries by 'drun.exe' or 'vt-windows-event-stream.exe' related to Chrome installation paths, and file access to Chrome's 'Local State' file by these processes.
Detects Python scripts or processes accessing common browser credential and cookie storage files (such as Login Data, key4.db, or cookies.sqlite) and subsequently making outbound network connections, indicating potential theft and exfiltration of browser data.
Detects suspicious attempts to access macOS Keychain or browser credentials (Chrome, Firefox) using 'osascript' or 'security' command-line utilities. This rule identifies patterns indicative of credential dumping or access, such as unlocking keychains, finding generic passwords, or accessing browser-specific credential files.
This rule detects attempts to access macOS Keychain credentials or web browser stored credentials using the 'security' command-line utility. It specifically looks for 'security unlock-keychain' and 'security find-generic-password' commands, with the latter also checking for common browser names like Chrome, Brave, and Microsoft Edge. This activity is indicative of an adversary attempting to dump credentials from the system.
Detects the forceful termination of web browsers using taskkill.exe, a common behavior for info stealers attempting to unlock browser databases.
Detects command line activity indicative of an attempt to access or extract browser-related files such as 'Cookies' or 'Local State', which are commonly associated with session theft or credential harvesting from major web browsers like Chrome, Firefox, Edge, and Safari.
Infostealer-as-a-service targeting browser credentials and crypto wallets
Detects a payload aggressively accessing browser credential stores (Login Data, Cookies, Web Data) in a rapid sequence, specifically when initiated by processes matching common VPN client names like GlobalProtect or AnyConnect. This behavior is indicative of infostealer activity, attempting to exfiltrate sensitive browser data.
Detects unauthorized processes attempting to access sensitive browser files such as 'Login Data', 'Cookies', and 'Web Data' files typically located in Chrome or Firefox user profiles. This behavior is indicative of credential theft or data exfiltration, as these files contain saved usernames, passwords, and session cookies.
This rule detects when processes other than legitimate browser-related binaries access Google Chrome's 'Login Data' or 'Local State' files. These files contain sensitive browser data, including stored credentials, and unauthorized access is a common indicator of credential theft or dumping attempts by malicious software.
Detects anomalous execution of chrome.exe as a child process of Python interpreters or PyInstaller-compiled binaries running from non-standard, user-writable directories. This pattern is indicative of the Glove Stealer malware attempting to perform a Chrome App-Bound Encryption (ABE) bypass by injecting a decryption helper DLL into a suspended chrome.exe process to exfiltrate master keys.
Detects unauthorized processes attempting to interact with the elevation_service.exe (the Chrome App-Bound Encryption service) via COM mechanisms. This activity is a known indicator of the Glove Stealer 'five-tier ABE bypass' technique, which is used to decrypt browser-stored credentials and session cookies by abusing the service's interface.
This rule detects unauthorized read access to Chromium-based browser sensitive files (Login Data, Cookies, Web Data) by processes other than known browser executables. This behavior is indicative of credential theft or session hijacking, often observed in malware such as Atlas RAT, ValleyRAT, and SilentRunLoader.
This rule detects non-browser processes attempting to read sensitive files within Chromium-based browser profiles, such as 'Login Data', 'Cookies', and 'Web Data'. Such activity is highly indicative of credential theft or session token exfiltration by malicious software targeting stored browser secrets.
Detects BQT.exe attempting to access sensitive browser credential stores or staging credential files.
Detects unauthorized processes (excluding known web browsers and system processes) attempting to access sensitive browser credential files (e.g., Login Data, key4.db) followed by a network connection to external IP addresses. This behavior is highly indicative of credential theft and subsequent exfiltration.
This rule detects unauthorized attempts by processes other than standard web browsers to access credential-related files, including browser login databases, Firefox key files, and known cryptocurrency wallet data files. These activities are indicative of credential harvesting or theft attempts by malicious software.
This rule detects the BQT.exe (BQTLock ransomware) process attempting to access web browser credential files (Chrome, Firefox, Opera) or creating a password staging file in the Windows Temp directory. This behavior is indicative of credential theft performed by the ransomware prior to or during the encryption process.
Detects a MobaXterm credential decryption utility reading session configuration or registry data before SSH or RDP activity, indicating potential credential access for lateral movement.
Page 26 of 34