Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
712 detections
Filters
Last updated
All Time
Detection languages
340
114
58
50
48
Contributors
244
152
92
68
16
Categories
570
437
139
95
76
Platforms
646
90
61
10
10
Products / Services
275
214
30
28
25
MITRE Techniques
18,123
15,646
12,594
8,402
6,230
712
CVEs
9
1
1
IDS Classtypes
9
IDS Protocols
8
1
Detects unauthorized access to Chrome and Firefox browser credential (Login Data, logins.json, key4.db) and cookie database files on macOS by non-browser processes, commonly observed in credential theft campaigns like ClickFix.
This rule detects attempts by non-browser processes to access sensitive browser files such as 'Login Data', 'Cookies', 'Web Data', 'logins.json', 'cookies.sqlite', 'formhistory.sqlite', and 'places.sqlite'. These files often contain credentials, session tokens, and browsing history. Legitimate browser processes are excluded from this detection to reduce false positives. This activity could indicate an attempt to steal user credentials or session information.
This rule detects non-browser processes attempting to access sensitive local files associated with common web browsers (Google Chrome, Microsoft Edge, and Mozilla Firefox). Specifically, it monitors for file events involving login databases, cookies, and key storage files by processes other than legitimate browser executables, which is a common technique used by credential-stealing malware.
This rule detects processes other than standard browsers (Chrome, Edge, Firefox, Opera) or authorized password managers (KeePass) accessing sensitive files such as browser credential stores, cookies, local state configuration files, KeePass databases (.kdbx), or VPN configuration files (.ovpn). The rule identifies suspicious activity by monitoring for access patterns that indicate potential credential theft or exfiltration.
Detects instances where non-browser processes (that are not signed by major browser vendors) attempt to access common browser credential files such as 'Login Data' or 'logins.json'. This behavior is characteristic of credential dumping or exfiltration attempts by malicious software trying to steal stored browser passwords.
This rule detects suspicious processes (e.g., cmd.exe, powershell.exe, curl.exe) or the execution of vaultcmd.exe accessing browser credential files (Login Data, Web Data, logins.json, key4.db) or utilizing DPAPI (CryptUnprotectData) to extract stored credentials. This behavior is indicative of credential harvesting often observed in infostealer campaigns.
This rule detects Python or Node.js processes aggressively accessing directories associated with cryptocurrency wallet browser extensions like MetaMask, Phantom, and Binance Chain. This activity is indicative of information stealer malware attempting to exfiltrate sensitive wallet data.
Detects unauthorized access, modification, or deletion attempts against common web browser credential storage files (key4.db, logins.json, and Microsoft Edge 'Login Data'). These files store sensitive authentication information, and non-browser processes interacting with them are indicative of credential harvesting attempts.
Detects unauthorized access, modification, or deletion attempts against common web browser credential storage files (key4.db, logins.json, and Microsoft Edge 'Login Data'). These files store sensitive authentication information, and non-browser processes interacting with them are indicative of credential harvesting attempts.
This rule detects unauthorized access, creation, or modification of browser-specific sensitive credential files (such as 'Login Data' or 'cookies.sqlite') by processes that are not recognized web browsers or trusted update services. This behavior is a common indicator of information-stealer malware attempting to harvest session cookies and stored credentials.
Detects instances where processes other than legitimate browser components attempt to access, read, or copy the browser 'Login Data' file. This file stores credentials used by Google Chrome and Microsoft Edge, and unauthorized access is a common technique used by credential-stealing malware.
Detects instances where processes other than legitimate browser components attempt to access, read, or copy the browser 'Login Data' file. This file stores credentials used by Google Chrome and Microsoft Edge, and unauthorized access is a common technique used by credential-stealing malware.
Detects node.exe copying browser history files to temporary directories, associated with the protocal.cjs backdoor.
This rule detects various methods used to extract credentials protected by the Windows Data Protection API (DPAPI). It covers multiple vectors, including Mimikatz DPAPI module usage, unauthorized loading of the dpapi.dll library, suspicious access to browser or WiFi credential stores, and cross-process memory access to the LSASS process to extract DPAPI master keys.
Detects unauthorized processes attempting to read, modify, or create files within common browser credential locations (Chrome, Firefox, Edge, and Windows Credential Manager). Legitimate browser processes and their known signers are excluded, focusing on suspicious secondary processes or tools frequently utilized by infostealers like Lumma and RedLine to dump credentials.
Detects instances where non-browser processes access sensitive browser-related files (Login Data, Cookies, or Local State) located within AppData directories. This behavior is highly indicative of credential and session token theft, often associated with AiTM or post-compromise information harvesting activities.
This rule detects unauthorized processes attempting to create, modify, rename, or delete the 'Login Data' SQLite database files used by Google Chrome and Microsoft Edge to store saved credentials. By excluding legitimate browser processes and updates, the rule identifies potential credential theft attempts by infostealer malware or unauthorized actor tools.
This rule detects unauthorized or suspicious processes attempting to access sensitive local browser extension data or known password manager vault files (e.g., .kdbx, vault.json, data.json). This behavior is characteristic of infostealer malware or credential-harvesting activities attempting to extract stored secrets.
This rule looks for programs with AI-themed names (e.g., chatgpt, copilot, claude) attempting to access browser credential stores, specifically targeting login data and cookies. This activity is a common step for attackers aiming to hijack user accounts. Alerts generated by this rule should prompt an investigation into the legitimacy of the initiating process. Users should be queried about recent software installations or clicked links, and security teams should be involved if the legitimacy remains unclear.
Detects unauthorized processes (those not identified as standard web browsers) accessing browser profile directories (Local Storage or IndexedDB) associated with major AI platforms such as OpenAI, ChatGPT, Anthropic, and Copilot. This behavior is indicative of credential theft or session token exfiltration from local browser storage.
Detects Python or a Cython module opening Chromium Login Data and Local State files outside browser execution. This activity is indicative of credential theft, specifically targeting web browser stored credentials.
Page 25 of 34