Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
711 detections
Filters
Last updated
All Time
Detection languages
340
114
58
50
47
Contributors
244
152
92
68
16
Categories
569
437
138
95
76
Platforms
645
90
61
10
10
Products / Services
275
214
30
28
25
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
711
CVEs
9
1
1
IDS Classtypes
9
IDS Protocols
8
1
Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access attempts. Adversaries may attempt to access browser credential storage to extract sensitive information such as usernames and passwords or cookies. This behavior is often commonly observed in credential stealing malware.
Yara rule that detects Skuld infostealer.
Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access attempts.
Adversaries may attempt to access browser credential storage to extract sensitive information such as usernames and passwords or cookies.
This behavior is often commonly observed in credential stealing malware.
Adversaries may attempt to access browser credential storage to extract sensitive information such as usernames and passwords or cookies.
This behavior is often commonly observed in credential stealing malware.
The analytic detects the creation of files containing passwords, cookies, and saved login account information by the Braodo stealer malware in temporary folders. Braodo often collects these credentials from browsers and applications, storing them in temp directories before exfiltration. This detection focuses on monitoring for the creation of files with patterns or formats commonly associated with stolen credentials. By identifying these activities, security teams can take needed action to prevent sensitive login data from being leaked, reducing the risk of unauthorized access to user accounts and systems.
The following analytic detects the copying of Chrome's Local State and Login Data files into temporary folders, a tactic often used by the Braodo stealer malware. These files contain encrypted user credentials, including saved passwords and login session details. The detection monitors for suspicious copying activity involving these specific Chrome files, particularly in temp directories where malware typically processes the stolen data. Identifying this behavior enables security teams to act quickly, preventing attackers from decrypting and exfiltrating sensitive browser credentials and mitigating the risk of unauthorized access.
The analytic identifies processes with command-line parameters associated with web browser credential dumping tools, specifically targeting behaviors used by Remcos RAT malware. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and specific file paths. This activity is significant as it indicates potential credential theft, a common tactic in broader cyber-espionage campaigns. If confirmed malicious, attackers could gain unauthorized access to sensitive web credentials, leading to further system compromise and data breaches.
This rule detects potential attempts to steal browser data by monitoring process creation events for specific command-line utilities (copy, move, xcopy, robocopy, esentutl) combined with paths commonly associated with web browser user data directories. Adversaries often acquire credentials from web browsers by copying or moving these files, which may contain saved usernames and passwords.
Adversaries may acquire credentials from web browsers by reading files specific to the target browser.
Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.
Web browsers typically store the credentials in an encrypted format within a credential store.
Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.
Web browsers typically store the credentials in an encrypted format within a credential store.
This rule detects the GomorrahStealer infostealer by identifying specific bytecode patterns associated with its capabilities. These capabilities include extracting browser autofill data, browser cookies, taking screenshots, gathering antivirus information, and collecting browser history. The rule looks for the presence of all these distinct bytecode signatures within a file to confirm the presence of GomorrahStealer.
Detects command-line keywords indicative of the execution of the WinPwn tool, which is used for Windows and Active Directory reconnaissance and exploitation. This rule specifically looks for 'Offline_Winpwn', 'WinPwn ', 'WinPwn.exe', or 'WinPwn.ps1' in the command line.
Detects scriptblock text keywords indicative of potential usage of the tool WinPwn. WinPwn is a tool for Windows and Active Directory reconnaissance and exploitation. The rule specifically looks for 'Offline_Winpwn', 'WinPwn ', 'WinPwn.exe', or 'WinPwn.ps1' within PowerShell script block logs.
Yara rule that detects Daolpu infostealer.
This rule detects the execution of the 'sqlite' or 'sqlite3' binary specifically when it is used to query sensitive data from Chromium-based browser profiles. The detection logic looks for command-line arguments that indicate access to common Chromium user data paths and specific database files containing login data, cookies, web data (credit cards, autofill), history, or bookmarks. This activity is highly indicative of an attempt to steal sensitive user information stored by web browsers.
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. This rule detects PowerShell commands attempting to copy browser login data files from common web browsers like Opera, Firefox, Microsoft Edge, and Google Chrome.
Detects the execution of WebBrowserPassView.exe, a password recovery tool that reveals passwords stored by various web browsers including Internet Explorer, Mozilla Firefox, Google Chrome, Safari, and Opera. This tool is often used by adversaries to extract credentials from compromised systems.
Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.
Detects the execution of WebBrowserPassView.exe. A password recovery tool that reveals the passwords stored by the following Web browsers, Internet Explorer (Version 4.0 - 11.0), Mozilla Firefox (All Versions), Google Chrome, Safari, and Opera
Adversaries may acquire credentials from web browsers by reading files specific to the target browser.
Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.
Web browsers typically store the credentials in an encrypted format within a credential store.
Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.
Web browsers typically store the credentials in an encrypted format within a credential store.
Page 34 of 34