Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
711 detections
Filters
Last updated
All Time
Detection languages
340
114
58
50
47
Contributors
244
152
92
68
16
Categories
569
437
138
95
76
Platforms
645
90
61
10
10
Products / Services
275
214
30
28
25
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
711
CVEs
9
1
1
IDS Classtypes
9
IDS Protocols
8
1
This rule detects attempts by non-browser executables to access DPAPI (Data Protection API) for decryption, specifically when the command line also references Chromium Local State. This behavior is indicative of credential theft, where an attacker might be trying to extract stored browser credentials. The rule filters out legitimate browser processes (Chrome, MS Edge, Brave) to reduce false positives and focuses on the causal chain of events.
Detects scripts (Python/Node/VBS) directly accessing Chrome or OS-level DPAPI structures (Login Data, Cookies) to extract user credentials.
Detects unauthorized processes aggressively reading Chromium and Safari browser database files (Login Data, Cookies, Web Data) on macOS, which is indicative of credential stealing attempts. The rule specifically looks for file access events to browser profile directories where these sensitive files are stored, excluding legitimate browser processes.
Detects the Grixba infostealer (v1.5+) enumerating sensitive browser data (history, cookies, etc.) from multiple common web browsers. The rule monitors for file access events initiated by processes running from non-standard locations such as C:\Users\Public\Music\ or identified by specific .NET binary names associated with Grixba.
Detects the execution of a malicious npm package (scope squatting on @withgoogle/stitch-sdk) that runs a preinstall script designed to harvest sensitive credentials (Claude, Git, SSH, GitHub, npm, Docker) and exfiltrate them to the domain 'stitch-production.org'.
Detects command line activity indicative of an attempt to access or extract browser-related files such as 'Cookies' or 'Local State', which are commonly associated with session theft or credential harvesting from major web browsers like Chrome, Firefox, Edge, and Safari.
This rule detects attempts by non-browser processes to access sensitive Chromium-based browser files such as 'Login Data', 'Cookies', 'History', 'Web Data', and 'Local State'. These files often contain credentials, browsing history, and other sensitive user data. The rule specifically filters for file access events where the accessing process's command line does not match known browser executables (chrome.exe, msedge.exe, brave.exe, opera.exe, vivaldi.exe), indicating potential credential theft or data exfiltration by malicious software.
Detects scripts (Python/Node/VBS) directly accessing Chrome or OS-level DPAPI structures (Login Data, Cookies) to extract user credentials.
Detects instances where a node.exe process attempts to open sensitive browser files such as 'Login Data' or 'Cookies', which are common targets for credential theft. Additionally, it monitors for network communication (DNS requests or HTTP connections) to the domain 'stitch-production.org', which may be a command and control (C2) endpoint.
Detects anomalous network communication with a known C2 domain associated with the Miasma worm, or attempts by JavaScript runtime processes (node, bun) to access sensitive developer-related files (SSH keys, cloud credentials, browser data) without an authorized IDE parent process.
Detects the execution of a Python-based collection module associated with the Gaslight malware on macOS. The module performs reconnaissance by enumerating system information using 'system_profiler' and running processes via 'ps aux', followed by the collection of sensitive data including browser files and the login keychain.
Detects instances of Chrome, Edge, or Brave browsers being launched with specific command-line arguments ('--no-first-run', '--disable-gpu', 'about:blank') by a non-browser parent process. This technique is commonly used by Vidar Stealer to create a child browser process that is vulnerable to memory injection or diagnostic manipulation, allowing the attacker to bypass Chrome Application-Bound Encryption (ABE) and extract master keys.
Detects unauthorized file read operations targeting local cryptocurrency wallet directories and browser extension storage (MetaMask, Phantom, etc.) by suspicious processes (e.g., node.exe, chost.exe) or processes executing from temporary or user-writable application directories, commonly associated with infostealer malware.
Detects unauthorized access to browser credential storage files (e.g., Login Data, Cookies, Local State) by suspicious non-browser processes such as node.exe, powershell.exe, or wscript.exe. This activity is often associated with infostealer malware, particularly in supply chain attacks where malicious scripts attempt to dump browser-saved credentials or session cookies.
Detects unauthorized access to Chromium-based and Firefox browser credential stores (Login Data, Cookies, logins.json) by processes executing from temporary directories (e.g., AppData, Temp). This behavior is characteristic of infostealer malware, such as CASTLESTEALER, often delivered via process injection or hollowed processes.
Detects a file containing a cluster of strings commonly associated with Chromium credential stealing malware. The strings include references to Chromium profile database files like 'Login Data', 'Network\Cookies', 'History', and 'Web Data', as well as 'Local State' (often used for encryption keys) and the Windows API function 'CryptUnprotectData', which is used to decrypt DPAPI-protected data.
Detects suspicious access to web browser credential files (Login Data, Cookies) by processes other than the browsers themselves. This could indicate an attempt to steal stored credentials.
Detects activity associated with the macOS.Gaslight credential stealer, specifically focusing on Python processes accessing the login.keychain-db, browser credential stores, creating a 'collected_data.zip' archive, and executing security or reconnaissance commands. This rule identifies file events (creation, modification, read, copy) related to keychain and archive staging, as well as process events involving the 'security' command for password extraction and 'ps' or 'system_profiler' for system reconnaissance, all initiated by Python.
This rule detects attempts by non-browser processes to access sensitive web browser credential files such as 'Login Data', 'key4.db', and 'logins.json'. This activity is highly indicative of credential dumping or information theft, as legitimate browser processes are excluded from the detection.
Detects instances where non-browser processes access sensitive browser-related files (Login Data, Cookies, or Local State) located within AppData directories. This behavior is highly indicative of credential and session token theft, often associated with AiTM or post-compromise information harvesting activities.
This rule detects unauthorized processes attempting to create, modify, rename, or delete the 'Login Data' SQLite database files used by Google Chrome and Microsoft Edge to store saved credentials. By excluding legitimate browser processes and updates, the rule identifies potential credential theft attempts by infostealer malware or unauthorized actor tools.
Page 29 of 34