Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
711 detections
Filters
Last updated
All Time
Detection languages
340
114
58
50
47
Contributors
244
152
92
68
16
Categories
569
437
138
95
76
Platforms
645
90
61
10
10
Products / Services
275
214
30
28
25
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
711
CVEs
9
1
1
IDS Classtypes
9
IDS Protocols
8
1
This rule detects attempts to access or exfiltrate DPAPI (Data Protection API) credentials stored in the 'CREDHIST' folder. Specifically, it looks for file events within the `\Microsoft\Protect\CREDHIST` folder where the initiating process is either `dpapisnoop.exe` or `powershell.exe`. `dpapisnoop.exe` is a known tool for DPAPI credential extraction, and PowerShell can also be used for similar purposes.
This rule detects attempts to exfiltrate browser password databases over HTTP. It specifically looks for HTTP POST requests containing the string "Login Data" in the client body, which is a common indicator of browser credential theft.
Detects the execution of cg.exe, a secondary Python executable dropped by SilentRunLoader specifically to pack and steal Chrome browser data. This activity is associated with TA4922.
This rule detects attempts to copy the Chrome Login Data SQLite file over SMB. The rule specifically looks for SMB traffic (port 445) containing the strings "Login Data" and "AppData\Local\Google\Chrome" (case-insensitive). This activity is indicative of an attacker trying to exfiltrate sensitive browser data, specifically stored credentials.
Detects the execution of `cg.exe`, a secondary Python executable dropped by SilentRunLoader specifically to pack and steal Chrome browser data. This behavior is indicative of TA4922 activity.
Detects unauthorized modification of the Google Chrome Secure Preferences file, specifically targeting the default search provider data to hijack browser searches. This behavior is actively used by malware such as FlutterShell to redirect all Chrome searches to attacker-controlled infrastructure.
This rule detects processes attempting to access web browser credential files (e.g., 'Login Data', 'Web Data') within the AppData directory. This activity is often associated with credential dumping techniques used by adversaries to steal stored browser credentials.
Detects the execution of the 'ChromeElevator' component, which is explicitly staged and utilized by the CrystalX RAT to extract and harvest credentials from Chromium-based web browsers.
This rule detects suspicious activity where a non-browser process attempts to decrypt credentials stored by Google Chrome or Microsoft Edge using DPAPI (Data Protection API). This could indicate an adversary attempting to steal stored browser credentials.
Detects HTTP POST requests to "/api/get_challenge" or "/api/get_credentials" on port 5000. This is the initial communication pattern of the TunnesshClient backdoor, a component of the BoryptGrab campaign, to retrieve SSH credentials from its C2 server before establishing a reverse SSH tunnel.
This rule detects the presence of a specific browser credential extraction module associated with the StealC information stealer, as used in the FakeGit campaign. The detection is based on the module's SHA256 hash. The rule looks for the presence of this hash in DeviceFileEvents (file creation on disk) or DeviceImageLoadEvents (module loaded into a process). This indicates an attempt to steal credentials from web browsers or web session cookies.
This rule detects the presence of a specific browser credential extraction module associated with the StealC information stealer, as used in the FakeGit campaign. The detection is based on the module's SHA256 hash.
Detects non-browser processes accessing sensitive files within web browser profiles, such as credential stores (Login Data), cookies, or local storage databases (LevelDB). This behavior is indicative of credential theft and was observed in multiple modules of the StegaBin infostealer toolkit, which targeted browser-stored credentials and cryptocurrency wallet extensions.
Detects a Node.js process accessing sensitive files such as environment configuration files (.env) or browser credential/session stores. This behavior was observed in a developer-targeting campaign where attackers exfiltrated secrets from compromised developer machines.
This detection identifies attempts by non-browser processes to access credential database files associated with common web browsers, including Chrome, Edge, and Brave. Such activity is commonly leveraged by threat actors to harvest stored credentials for the purpose of lateral movement and further system compromise. Notably, this technique has been observed in campaigns attributed to MuddyWater Operation Olalampo.
Detects a possible capture of credentials saved in browsers.
Detects the creation of the file 'decrypted_appbound_key.txt' in the AppData\Roaming directory. This file is a specific artifact generated by the CRESCENTHARVEST malware after it successfully decrypts Chrome's app-bound encryption key, indicating browser credential compromise.
Detects events that may indicate a user is being enrolled into a Bitwarden organization's account recovery policy under malicious circumstances. As described by researchers, a malicious or compromised server can silently add a user to an attacker-controlled organization and enable an account recovery policy. The victim's client will then encrypt the user's vault key with an attacker-provided public key and upload it, leading to a full vault compromise.
Detects the creation or modification of a browser extension's manifest.json file configured to inject a script into the 'MAIN' world context of chatgpt.com. This technique allows the extension to bypass the isolated content script environment, hook native APIs like window.fetch, and steal session tokens, as seen in a campaign targeting ChatGPT users.
This rule detects the XenoRAT info stealer and Remote Access Trojan (RAT) by identifying specific strings related to its functionalities. It looks for configuration parameters like 'HostName', 'PortNumber', 'UserName', and 'Password' which are typically supplied at runtime for C2 communication. The rule also identifies strings associated with browser data exfiltration ('Local Extension Settings', 'Sync Extension Settings', 'chromium_plugins', 'logins.json', 'profiles.ini', 'IndexedDB', 'chrome-extension_'), crypto wallet theft ('ChainingModeGCM'), file grabbing capabilities ('%DRIVE_FIXED%', '%DRIVE_REMOVABLE%', 'File Grabber'), and HVNC-style desktop control ('Chrome_WidgetWinOperaWindowClass', 'CreateDesktopA', 'OpenDesktopA'). Additionally, it includes specific hashes of known XenoRAT samples for direct identification.
This rule detects potential credential harvesting and cryptocurrency wallet theft activities, specifically targeting browser data, SSH keys, cloud credentials, and crypto wallets. It looks for command-line patterns indicative of accessing or copying these sensitive files. The rule also includes a condition for Node.js processes attempting to exfiltrate credential-related data. The detection logic combines multiple conditions, such as browser credential access with SSH key theft, or cloud credential access with crypto wallet access, and Node.js exfiltration attempts combined with any of the credential/wallet access patterns.
Page 31 of 34