Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
38 detections
Filters
Last updated
All Time
Detection languages
19
7
3
3
2
Contributors
10
7
7
4
2
Categories
32
25
14
11
6
Platforms
33
4
3
2
1
Products / Services
15
15
5
4
3
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
1
1
Detects Node.js processes accessing paths associated with cryptocurrency wallets and browser extension storage (MetaMask, Phantom, Exodus, Electrum). This behavior is characteristic of infostealer malware attempting to exfiltrate seed phrases, keys, or wallet configuration data.
Detects node.exe (often associated with malicious npm package runtimes) accessing local credential store files such as KeePass, 1Password, and Bitwarden. This activity is indicative of infostealer payloads (e.g., Miasma/MYRA) targeting developer workstations to exfiltrate sensitive credential databases.
This rule detects unauthorized or suspicious processes attempting to access sensitive local browser extension data or known password manager vault files (e.g., .kdbx, vault.json, data.json). This behavior is characteristic of infostealer malware or credential-harvesting activities attempting to extract stored secrets.
This rule detects unauthorized or suspicious processes attempting to access sensitive local browser extension data or known password manager vault files (e.g., .kdbx, vault.json, data.json). This behavior is characteristic of infostealer malware or credential-harvesting activities attempting to extract stored secrets.
This rule detects instances where Python interpreter processes (python.exe, python3.exe) access sensitive cryptocurrency wallet or keystore files. This behavior is indicative of unauthorized information collection or wallet stealer malware activity targeting local system assets.
Detects unauthorized processes attempting to read KeePass database files (.kdbx) or VPN configuration files (.ovpn, .vpn) from user directories. This behavior is consistent with the GIFTEDCROOK stealer and UAC-0226 activity, aimed at harvesting credentials from password managers and VPN clients.
This rule detects potential exfiltration of password manager database files over HTTP. It specifically looks for HTTP POST requests with a URI containing common password manager names (keepass, lastpass, 1password, bitwarden) and a data size greater than 1000 bytes. This combination suggests a large file, potentially a database, is being uploaded.
This rule detects when a KeePass database file (.kdbx) is copied to a server via SMB. This could indicate an attempt to exfiltrate sensitive credential data.
The following analytic detects suspicious attempts to find credentials stored in password stores, indicating a potential attacker's effort to access sensitive login information. Password stores are critical repositories that contain valuable credentials, and unauthorized access to them can lead to significant security breaches. By monitoring for unusual or unauthorized activities related to password store access, this analytic helps identify potential credential theft attempts, allowing security teams to respond promptly and prevent unauthorized access to critical systems and data.
The following analytic identifies command-line activity that searches for files related to password manager software, such as "*.kdbx*" and "*credential*". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant because attackers often target password manager databases to extract stored credentials, which can be used for further exploitation. If confirmed malicious, this behavior could lead to unauthorized access to sensitive information, enabling attackers to escalate privileges, move laterally, or exfiltrate critical data.
Detects components of the KimJongRAT PE variant, including the orchestrator (NetworkService.dll), loader (sys.dll/baby.dll), and stealer (dwm.dll), based on unique strings, PDB paths, and network communication artifacts.
KQL Query from file: Azure Cloud Security Monitoring
Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity
Prior to deploying Macaw ransomware in an organization, the adversary will disable several tools and functions in order to inhibit later recovery efforts.
The following analytic detects suspicious attempts to find credentials stored in password managers, which may indicate an attacker's effort to retrieve sensitive login information. Password managers are often targeted by adversaries seeking to access stored passwords for further compromise or lateral movement within a network. By monitoring for unusual or unauthorized access to password manager files or processes, this analytic helps identify potential credential theft attempts, enabling security teams to respond quickly to protect critical accounts and prevent further unauthorized access.
This rule detects the creation of a remote thread within the KeePass.exe process. This activity is highly suspicious as it can indicate an attacker attempting to inject malicious code into KeePass to extract sensitive information, such as master passwords or stored credentials. This technique is commonly used by tools like KeeFarce and KeeThief for password dumping from KeePass.
Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity
Page 2 of 2