Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
38 detections
Filters
Last updated
All Time
Detection languages
19
7
3
3
2
Contributors
10
7
7
4
2
Categories
32
25
14
11
6
Platforms
33
4
3
2
1
Products / Services
15
15
5
4
3
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
1
1
The following analytic identifies command-line activity that searches for files related to password manager software, such as "*.kdbx*" and "*credential*". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant because attackers often target password manager databases to extract stored credentials, which can be used for further exploitation. If confirmed malicious, this behavior could lead to unauthorized access to sensitive information, enabling attackers to escalate privileges, move laterally, or exfiltrate critical data.
Detects the behavior of LunexStealer targeting cryptocurrency wallets. The rule monitors for the enumeration of known crypto wallet files and browser-stored extension data, followed closely by the creation of a 'wallet.zip' archive by the same process, which is indicative of staged data collection for exfiltration.
Detects the behavior of LunexStealer targeting cryptocurrency wallets. The rule monitors for the enumeration of known crypto wallet files and browser-stored extension data, followed closely by the creation of a 'wallet.zip' archive by the same process, which is indicative of staged data collection for exfiltration.
Detects the behavior of LunexStealer targeting cryptocurrency wallets. The rule monitors for the enumeration of known crypto wallet files and browser-stored extension data, followed closely by the creation of a 'wallet.zip' archive by the same process, which is indicative of staged data collection for exfiltration.
Detects a specific attack chain attributed to ClosedQuorum, involving LSASS memory dumping, subsequent access to browser-based credential stores or cryptocurrency wallet files, and finally staging the stolen data in C:\Windows\Temp\ within a short time window.
Detects the behavior of LunexStealer targeting cryptocurrency wallets. The rule monitors for the enumeration of known crypto wallet files and browser-stored extension data, followed closely by the creation of a 'wallet.zip' archive by the same process, which is indicative of staged data collection for exfiltration.
Detects the behavior of LunexStealer targeting cryptocurrency wallets. The rule monitors for the enumeration of known crypto wallet files and browser-stored extension data, followed closely by the creation of a 'wallet.zip' archive by the same process, which is indicative of staged data collection for exfiltration.
Detects a specific attack chain attributed to ClosedQuorum, involving LSASS memory dumping, subsequent access to browser-based credential stores or cryptocurrency wallet files, and finally staging the stolen data in C:\Windows\Temp\ within a short time window.
Detects non-browser processes performing file operations (create, modify, rename) on known web browser credential storage, configuration files, and cryptocurrency wallet artifacts in a short duration. This behavior is indicative of credential harvesting or information stealing activity often associated with malware like Vidar, which stages these sensitive files for exfiltration.
Detects non-browser processes performing file operations (create, modify, rename) on known web browser credential storage, configuration files, and cryptocurrency wallet artifacts in a short duration. This behavior is indicative of credential harvesting or information stealing activity often associated with malware like Vidar, which stages these sensitive files for exfiltration.
Detects non-browser processes performing file operations (create, modify, rename) on known web browser credential storage, configuration files, and cryptocurrency wallet artifacts in a short duration. This behavior is indicative of credential harvesting or information stealing activity often associated with malware like Vidar, which stages these sensitive files for exfiltration.
Detects non-browser processes performing file operations (create, modify, rename) on known web browser credential storage, configuration files, and cryptocurrency wallet artifacts in a short duration. This behavior is indicative of credential harvesting or information stealing activity often associated with malware like Vidar, which stages these sensitive files for exfiltration.
Detects a specific attack chain attributed to ClosedQuorum, involving LSASS memory dumping, subsequent access to browser-based credential stores or cryptocurrency wallet files, and finally staging the stolen data in C:\Windows\Temp\ within a short time window.
Detects a specific attack chain attributed to ClosedQuorum, involving LSASS memory dumping, subsequent access to browser-based credential stores or cryptocurrency wallet files, and finally staging the stolen data in C:\Windows\Temp\ within a short time window.
Detects a specific attack chain attributed to ClosedQuorum, involving LSASS memory dumping, subsequent access to browser-based credential stores or cryptocurrency wallet files, and finally staging the stolen data in C:\Windows\Temp\ within a short time window.
This rule detects unauthorized access attempts by non-browser processes to specific browser extension storage directories. It focuses on directories associated with password managers, 2FA authenticators, and cryptocurrency wallets, as well as core browser credential files (e.g., Login Data, Cookies, logins.json). This behavior is characteristic of info-stealer malware, such as the Remus infostealer, attempting to exfiltrate sensitive data stored by browsers.
This rule detects the presence of the Amatera (ACR Stealer) loader by identifying characteristic indicators, including specific Telegra.ph dead-drop URLs, domain-fronting artifacts using github.com, and hardcoded C2 IP addresses. It also identifies credential theft targeting by searching for artifacts related to password managers such as KeePass, Bitwarden, WinAuth, and Authy, combined with the presence of C2 communication indicators.
Detects instances where a process other than the authorized password manager application (e.g., 1Password, Bitwarden, KeePass) attempts to create, modify, rename, or read sensitive database files associated with these password managers. This behavior may indicate an attempt to exfiltrate or compromise stored credentials.
Detects file access or read operations performed against known password manager database files (1Password, Bitwarden). This activity may indicate an attempt to acquire credentials from local storage.
This rule detects unauthorized attempts by non-browser processes to access sensitive browser-related files (Login Data, Cookies, Web Data, etc.) or interact with browser processes to extract secrets. It monitors for Sysmon Event IDs 10 (ProcessAccess), 11 (FileCreate), 7 (ImageLoad), and 1 (ProcessCreate) where a suspicious process (often located in temporary or user profile directories) attempts to read or interact with known browser credential storage paths.
This rule detects unauthorized read access to sensitive credential stores (KeePass .kdbx) and VPN configuration files (OpenVPN, Cisco AnyConnect, WireGuard) by processes that are not recognized credential or VPN management software. It specifically monitors for processes exhibiting suspicious lineage, such as those spawned by PowerShell or running from the C:\ProgramData directory, which is a common technique used by attackers to hide malicious activity.
Page 1 of 2