Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
56 detections
Filters
Last updated
All Time
Detection languages
29
13
10
3
1
Contributors
54
2
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
24
23
5
3
3
Products / Services
16
15
7
4
4
MITRE Techniques
16
11
8
7
6
CVEs
11
IDS Classtypes
2
1
IDS Protocols
1
1
1
Detects a non-Chrome, unsigned process reading Chrome's Sync Data LevelDB store, where encrypted WebauthnCredentialSpecifics passkey records are persisted, consistent with the collection stage of a Pass-ta-key credential-theft chain. Excludes Chrome itself, known backup/sync clients, the Windows Search indexer, and signed security/EDR tooling.
Detects OAuth2 token requests scoped to Google's secureidentity.action, used for passkey/security-domain-secret operations. Chrome's own sync/passkey process routinely requests this scope from the browser, so those requests (identified by a Chrome User-Agent) are excluded. Remaining matches indicate the token request did not originate from the legitimate Chrome browser process (e.g. a non-browser client, script, or tool crafting the request directly), which is anomalous and warrants investigation for possible passkey/security-domain-secret abuse or token reuse across devices.
Detects a non-browser process (unsigned, or not matching the legitimate Chrome/Edge install path and signature) invoking Windows CNG NCrypt APIs against the TPM-backed platform crypto provider, consistent with an attacker mimicking Chrome's passkey identity/UV key signing flow to forge authentication (Pass-ta-key). Excludes correctly signed Chrome and Edge processes running from their standard install locations.
Detects automated or scripted access to Chrome's internal chrome://device-log/FIDO diagnostics page, or command-line evidence of 'security domain secret'/keys/wrap content, which can unintentionally expose the Security Domain Secret (SDS) master key. Scoped to headless/automation-flagged or script-launched Chrome processes to reduce noise from manual developer/support troubleshooting.
Detects automated or scripted access to Chrome's internal chrome://device-log/FIDO diagnostics page, or command-line evidence of 'security domain secret'/keys/wrap content, which can unintentionally expose the Security Domain Secret (SDS) master key. Scoped to headless/automation-flagged or script-launched Chrome processes to reduce noise from manual developer/support troubleshooting.
Detects OAuth2 token requests scoped to Google's secureidentity.action, used for passkey/security-domain-secret operations. Chrome's own sync/passkey process routinely requests this scope from the browser, so those requests (identified by a Chrome User-Agent) are excluded. Remaining matches indicate the token request did not originate from the legitimate Chrome browser process (e.g. a non-browser client, script, or tool crafting the request directly), which is anomalous and warrants investigation for possible passkey/security-domain-secret abuse or token reuse across devices.
Detects a network connection to Google's passkey enclave or caBLE hybrid-transport domain (*.ua5v.com) that should be correlated with EDR process telemetry to confirm the source process is non-browser, unsigned, or otherwise anomalous rather than the legitimate Chrome browser.
Detects a non-browser process (unsigned, or not matching the legitimate Chrome/Edge install path and signature) invoking Windows CNG NCrypt APIs against the TPM-backed platform crypto provider, consistent with an attacker mimicking Chrome's passkey identity/UV key signing flow to forge authentication (Pass-ta-key). Excludes correctly signed Chrome and Edge processes running from their standard install locations.
Detects connections to the local CDP WebSocket server on port 18907 tied to the chrome_remote/browser_remote backdoor family, used for session-cookie theft, password capture, browser API hooking, and MetaMask/dApp manipulation.
Detects XCSSET resetting the TCC AppleEvents permission database via tccutil resetAppleEvents correlated with a subsequent fake System Settings/Xcode consent prompt, excluding known MDM tooling.
Detects XCSSET resetting the TCC AppleEvents permission database via tccutil resetAppleEvents correlated with a subsequent fake System Settings/Xcode consent prompt, excluding known MDM tooling.
Detects trojanized Finder/Xcode/Terminal/Reminders/SimulatorTrampoline application bundles located outside their standard system paths with ad-hoc or invalid code signatures, used to misuse and reset TCC permissions.
Detects trojanized Finder/Xcode/Terminal/Reminders/SimulatorTrampoline application bundles located outside their standard system paths with ad-hoc or invalid code signatures, used to misuse and reset TCC permissions.
Detects connections to the local CDP WebSocket server on port 18907 tied to the chrome_remote/browser_remote backdoor family, used for session-cookie theft, password capture, browser API hooking, and MetaMask/dApp manipulation.
Page 3 of 3