Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
711 detections
Filters
Last updated
All Time
Detection languages
340
114
58
50
47
Contributors
244
152
92
68
16
Categories
569
437
138
95
76
Platforms
645
90
61
10
10
Products / Services
275
214
30
28
25
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
711
CVEs
9
1
1
IDS Classtypes
9
IDS Protocols
8
1
This rule detects unauthorized or suspicious processes attempting to access sensitive local browser extension data or known password manager vault files (e.g., .kdbx, vault.json, data.json). This behavior is characteristic of infostealer malware or credential-harvesting activities attempting to extract stored secrets.
This rule detects attempts by unsigned or suspicious processes (often residing in temporary directories) to access sensitive cryptocurrency wallet files such as 'wallet.dat', keystore JSON files, and files containing recovery seed phrases. This behavior is indicative of credential theft commonly associated with infostealer campaigns like DeepLoad and DeerStealer.
Detects behavior indicative of the InvisibleFerret information stealer, specifically focusing on Python execution spawned by development tools (VS Code/Node.js), unauthorized access to browser-based credential stores or local crypto wallets, and suspicious outbound network activity originating from Python processes spawned by development/automation tools.
Detects instances where a process not associated with a known web browser attempts to read sensitive browser credential stores (such as Chrome Login Data, Edge Login Data, or Firefox key4.db/logins.json). This behavior is characteristic of infostealers attempting to extract saved browser credentials.
This rule detects instances where development-related processes (such as Code.exe or node.exe) spawn web browser processes (like chrome.exe, firefox.exe, or msedge.exe). This pattern is often indicative of an adversary attempting to leverage developer environments or cross-platform applications to interact with browser-based session data, cookies, or cached credentials.
Detects Python or Node.js interpreter processes accessing sensitive files related to cryptocurrency wallets and browser extensions, a behavior consistent with information-stealer malware such as InvisibleFerret used in the Contagious Interview campaign.
Detects instances where common scripting engines such as node.exe, python.exe, or related variants access known web browser credential storage files (e.g., Login Data, Cookies, logins.json). This behavior is characteristic of info-stealing malware, notably identified in the BeaverTail and InvisibleFerret malware families used during the 'Contagious Interview' campaign to exfiltrate sensitive browser data.
Detects modification of scripts in extension folders.
This rule monitors web browser processes (msedge.exe, chrome.exe) for two distinct behaviors: performing network connections to known command and control (C2) or exfiltration domains, and accessing sensitive browser files such as cookies, login data, or web data files.
This rule monitors for unauthorized access to the Google Chrome 'Login Data' database file by processes other than standard browser executables. It also detects the creation of known file artifacts associated with credential-stealing malware or RATs (e.g., 'chrome_logins_dump.txt' or 'gather.tar.gz'), which are indicative of credential harvesting activities.
Detects unauthorized processes accessing the Google Chrome 'Login Data' SQLite database file or the creation of a 'chrome_logins_dump.txt' file, which are indicators of potential credential theft activity often seen in RATs or information stealers.
Detects unauthorized processes accessing the Google Chrome 'Login Data' SQLite database file or the creation of a 'chrome_logins_dump.txt' file, which are indicators of potential credential theft activity often seen in RATs or information stealers.
Detects unauthorized access to web browser sensitive files, including credential stores, cookies, and local state files, by processes other than standard browsers or their update mechanisms. This rule also flags access to specific staging directories or archive files associated with known malicious activity.
Detects a process rapidly accessing multiple target credential stores (Login Data, Cookies, Web Data, places.sqlite) within a short time frame (1 minute). This behavior is indicative of credential stealer malware like Vidar attempting to exfiltrate sensitive browser data.
Detects unauthorized access to sensitive browser files, such as login databases, cookies, and encryption keys (e.g., key4.db, Login Data), from Chromium and Firefox-based browsers by processes other than the browsers themselves. The rule requires multiple distinct credential files to be accessed to minimize false positives.
Detects unauthorized access to browser credential and sensitive configuration files (e.g., Login Data, cookies, key4.db) by processes that are not legitimate web browsers. The rule specifically accounts for known GIFTEDCROOK browser-stealing behavior by excluding legitimate browser subprocesses like utility, crashpad, or gpu processes.
This rule detects when a non-standard or unexpected process attempts to access multiple sensitive credential files simultaneously. Specifically, it monitors for file access to Chrome login data, Firefox login and cookie databases, or KeePass database files (.kdbx). By flagging processes that access two or more distinct types of these files, the rule identifies potential credential dumping or harvesting attempts by malicious software not associated with legitimate browser or password manager activity.
Detects instances where non-browser processes (that are not signed by major browser vendors) attempt to access common browser credential files such as 'Login Data' or 'logins.json'. This behavior is characteristic of credential dumping or exfiltration attempts by malicious software trying to steal stored browser passwords.
Detects non-browser processes accessing sensitive browser data files (such as Login Data, Cookies, or key stores) followed by network activity to known suspicious, cryptocurrency, or potential malware-hosting domains. This behavior is indicative of credential theft and exfiltration by information-stealing malware.
Detects the AMOS infostealer attempting to access and enumerate browser extension directories on macOS to harvest cryptocurrency wallet data from Chrome and Firefox profiles.
Detects potential information stealing activity, specifically the Atomic macOS Stealer (AMOS) malware, by monitoring unauthorized processes accessing Safari cookies and Apple Notes databases, excluding legitimate applications.
Page 28 of 34