Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
711 detections
Filters
Last updated
All Time
Detection languages
340
114
58
50
47
Contributors
244
152
92
68
16
Categories
569
437
138
95
76
Platforms
645
90
61
10
10
Products / Services
275
214
30
28
25
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
711
CVEs
9
1
1
IDS Classtypes
9
IDS Protocols
8
1
Detects the creation of a browser process in headless mode and in a suspended state. This technique is used by infostealers like AuraStealer to inject code into the browser process to bypass Application-Bound Encryption (ABE) and steal credentials.
Detects the ToddyCat APT group's technique of using PowerShell to connect to remote hosts via SMB admin shares (C$) and steal web browser credentials. This is associated with a variant of the TomBerBil tool and is particularly significant when observed originating from a domain controller.
Multiple threat actors are compromising Microsoft 365 accounts in phishing attacks that leverage the OAuth device code authorization mechanism.
Attackers trick victims into entering a device code on Microsoft’s legitimate device login page, unknowingly authorizing an attacker-controlled application and granting them access to the target account without stealing credentials or bypassing multi-factor authentication (MFA).
Attackers trick victims into entering a device code on Microsoft’s legitimate device login page, unknowingly authorizing an attacker-controlled application and granting them access to the target account without stealing credentials or bypassing multi-factor authentication (MFA).
Detects access to Chrome profile data and Login Data database associated with credential theft activities linked to FlexibleFerret malware on macOS.
Detects a potential ToddyCat APT technique where a single source remotely accesses sensitive browser or DPAPI credential files on multiple hosts via SMB. This behavior is consistent with the group's TomBerBil PowerShell script used for widespread credential harvesting.
Detects the collection and staging of sensitive user data, such as credentials from keychains, browser profiles, and cryptocurrency wallets, by compressing them into an archive. This behavior is a key component of the DigitStealer infostealer's data theft process.
Detects Airstalk malware, which exists in both PowerShell and .NET variants. The rule identifies specific strings related to its C2 communication over the AirWatch MDM API, tasking, and other unique artifacts.
Yara rule that detects WeaselStore infostealer.
Detects PhantomVAI Loader and its common payload, Katz Stealer. PhantomVAI is a .NET loader known for delivering various infostealers and uses VM detection techniques. Katz Stealer is an infostealer notable for its anti-CIS country checks to evade analysis.
Detects access to sensitive browser files by non-browser processes. This can indicate attempts by malware to steal credentials, cookies or other sensitive user data.
The following analytic detects a non-Chrome process accessing files in the Chrome user default folder. It leverages Windows Security Event logs, specifically event code 4663, to identify unauthorized access attempts. This activity is significant because the Chrome default folder contains sensitive user data such as login credentials, browsing history, and cookies. If confirmed malicious, this behavior could indicate an attempt to exfiltrate sensitive information, often associated with RATs, trojans, and advanced persistent threats like FIN7. Such access could lead to data theft and further compromise of the affected system.
This rule detects when processes other than Firefox or Windows Explorer attempt to access the Firefox profile directory. This directory contains sensitive user data like login credentials, browsing history, and cookies. Such activity, monitored via Windows Security Event 4663, could indicate malware (e.g., RATs, trojans) trying to harvest user information, potentially leading to data exfiltration, unauthorized account access, and system compromise.
The following analytic detects non-Chrome processes accessing the Chrome "Local State" file, which contains critical settings and information. It leverages Windows Security Event logs, specifically event code 4663, to identify this behavior. This activity is significant because threat actors can exploit this file to extract the encrypted master key used for decrypting saved passwords in Chrome. If confirmed malicious, this could lead to unauthorized access to sensitive information, posing a severe security risk. Monitoring this anomaly helps identify potential threats and safeguard browser-stored data.
Detects file access requests to browser credential stores by uncommon processes. This could indicate a potential attempt at credential stealing. This rule requires heavy baselining before usage to reduce false positives.
Detects scenarios where an attacker attempt to dump browser credentials (Firefox, Google Chrome, ...) via network share.
Detects processes accessing sensitive browser files which may indicate credential theft from web browsers.
The following analytic detects non-Chrome processes attempting to access the Chrome extensions file. It leverages Windows Security Event logs, specifically event code 4663, to identify this behavior. This activity is significant because adversaries may exploit this file to extract sensitive information from the Chrome browser, posing a security risk. If confirmed malicious, this could lead to unauthorized access to stored credentials and other sensitive data, potentially compromising the security of the affected system and broader network.
Detects the RustDoor malware for macOS. This backdoor, written in Rust, is used by North Korean threat actors to target software developers in the cryptocurrency sector. It often masquerades as a legitimate software update or component.
Detects the Koi Stealer macOS variant, an infostealer targeting cryptocurrency wallets and sensitive user data. This malware is linked to North Korean threat actors.
Detects potential Raven Stealer activity by identifying known artifacts such as specific file paths, created filenames, command-line arguments, network connections, and file hashes.
Detects components of the KimJongRAT PE variant, including the orchestrator (NetworkService.dll), loader (sys.dll/baby.dll), and stealer (dwm.dll), based on unique strings, PDB paths, and network communication artifacts.
Page 32 of 34