Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
712 detections
Filters
Last updated
All Time
Detection languages
340
114
58
50
48
Contributors
244
152
92
68
16
Categories
570
437
139
95
76
Platforms
646
90
61
10
10
Products / Services
275
214
30
28
25
MITRE Techniques
18,123
15,646
12,594
8,402
6,230
712
CVEs
9
1
1
IDS Classtypes
9
IDS Protocols
8
1
This rule detects the BQT.exe (BQTLock ransomware) process attempting to access web browser credential files (Chrome, Firefox, Opera) or creating a password staging file in the Windows Temp directory. This behavior is indicative of credential theft performed by the ransomware prior to or during the encryption process.
Detects a MobaXterm credential decryption utility reading session configuration or registry data before SSH or RDP activity, indicating potential credential access for lateral movement.
Detects instances where a Node.js process accesses or modifies browser-related credential, cookie, or configuration files. This behavior is indicative of unauthorized data collection or credential harvesting from locally stored web browser profiles.
This rule detects instances where a Node.js process accesses sensitive files associated with web browsers (e.g., Login Data, Cookies) or SSH keys (e.g., id_rsa). This behavior is often indicative of credential theft or unauthorized data collection, where an adversary uses legitimate tooling like Node.js to stage or exfiltrate sensitive local files.
Detects unauthorized file read activity by node.exe targeting browser-based crypto wallet vault files, specifically 'Local Extension Settings'. This behavior is consistent with infostealer malware (such as Miasma/MYRA) using malicious JavaScript payloads to harvest sensitive encrypted vault data from developer environments.
Detects AstarionRAT's infostealing capability rapidly accessing multiple Chromium and Firefox SQLite databases to steal credentials and cookies.
Detects unauthorized file access to browser extension directories and credential stores (History, Login Data) by a suspicious Node.js process named 'protocal.cjs'. This activity is characteristic of the 'easy-day-js' supply chain compromise, where a malicious backdoor attempts to exfiltrate browser-stored credentials and history from Chrome, Edge, and Brave browsers.
Detects unauthorized processes attempting to read sensitive application data directories (specifically for Telegram and Discord) on macOS. This behavior is indicative of infostealer malware, such as AMOS (Atomic macOS Stealer), attempting to exfiltrate session tokens and account information.
Detects suspicious processes accessing, reading, or deleting browser credential stores (like 'Login Data', 'cookies.sqlite'). The rule specifically monitors for patterns where non-browser processes interact with these files, particularly when both file read and deletion actions are observed, which is a technique used by Remcos RAT to wipe existing sessions and force re-authentication for harvesting.
Detects node.exe processes attempting to access sensitive browser credential databases, such as cookies, login data, or key databases. This pattern is indicative of infostealer malware, specifically those associated with the Polymarket Trap supply-chain campaign, which abuse node.js processes to exfiltrate browser data.
This rule detects the Miasma infostealer activity by monitoring for Node.js processes directly reading sensitive browser credential and cookie databases (e.g., 'Login Data', 'Cookies', 'logins.json') associated with Chrome, Brave, Chromium, and Firefox. The detection targets the behavior where malicious scripts use tools like sql.js to parse and harvest these local files for exfiltration.
Detects instances where a Node.js process accesses or interacts with common web browser credential files, such as 'Login Data', 'Cookies', or 'key4.db'. This behavior is characteristic of credential-stealing malware or unauthorized collection scripts targeting browser-stored data.
Detects Node.js processes (node, npm) attempting to access sensitive files typically associated with web browser extensions, cryptocurrency wallets, or stored secrets. This activity is indicative of credential theft or data exfiltration attempts.
Detects instances where processes other than legitimate browser-related binaries access sensitive SQLite database files (Login Data and Cookies) associated with Google Chrome or Microsoft Edge. This activity is a common indicator of credential theft by malicious tools or scripts attempting to extract stored passwords or session cookies.
Detects instances where processes other than legitimate browser-related binaries access sensitive SQLite database files (Login Data and Cookies) associated with Google Chrome or Microsoft Edge. This activity is a common indicator of credential theft by malicious tools or scripts attempting to extract stored passwords or session cookies.
Detects instances where processes other than legitimate browser-related binaries access sensitive SQLite database files (Login Data and Cookies) associated with Google Chrome or Microsoft Edge. This activity is a common indicator of credential theft by malicious tools or scripts attempting to extract stored passwords or session cookies.
Detects processes accessing credential store paths across browsers, FTP clients, email, SSH, and IM clients in a pattern consistent with Pony (Fareit/Siplog) modular credential grabber walking well-known AppData credential store locations. The rule specifically looks for file read or access actions on common credential files within typical application data directories, while excluding legitimate processes that would normally access these files.
Detects network activity associated with the 'Adblock for YouTube' Chrome extension (ID: cmedhionkhpnakcndndgjdbohmhepckk) as it retrieves malicious scripts from 'api.adblock-for-youtube.com'. These scripts are designed to access sensitive browser data, including session cookies, localStorage, and sessionStorage, and potentially interact with site-specific login form elements within the user's browser session.
Detects processes accessing credential store paths across browsers, FTP clients, email, SSH, and IM clients in a pattern consistent with Pony (Fareit/Siplog) modular credential grabber walking well-known AppData credential store locations. The rule specifically looks for file read or access events on common credential files within typical application data directories, while excluding legitimate browser and application processes.
This rule detects malicious activity associated with the TONResolver RAT, which leverages node.exe to execute JavaScript payloads stored in AppData\Local\Nodejs. The rule monitors for multiple suspicious behaviors, including outbound C2 beaconing to known malicious domains, spawning of suspicious child processes (powershell.exe, cmd.exe, wscript.exe, cscript.exe), unauthorized access to browser-based credential stores (Login Data and Cookies), and establishment of persistence via Windows Registry Run keys.
Detects the correlation of a PowerShell process spawned by Explorer using a bypass execution policy, followed by a local Node.js process accessing web browser cookie files (Chrome, Edge, or Brave). This behavior is indicative of a potential credential theft attempt where an attacker uses PowerShell to prepare the environment and a helper process to extract browser session cookies.
Page 27 of 34