Credential Combolist / Stealer-Log Line

Detects credential combolist / infostealer-log lines: email:password pairs and host-or-url:user:pass triples, the format in which stolen credentials are aggregated and traded after info-stealer infections. These dumps fuel credential stuffing and account-takeover attacks. A lone email/password candidate is discovery-only; service-bound triples and multi-row dump structure support enforcement.

Type

regex

Engine

universal

Confidence

medium

Confidence justification

Medium confidence: the email:password and host:user:pass structures are distinctive for credential dumps, but a colon-delimited token can also appear in URLs, config files and timestamps, so corroborating context is needed for high assurance.

Jurisdictions

global

Regulations

GDPR

Frameworks

CIS Controls, ISO 27001, NIST CSF, SOC 2

Data categories

credentials, security

Scope

narrow

Risk rating

8

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Degraded

Pattern

[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9.-]{1,253}\.[A-Za-z]{2,24}:[^\s:]{4,128}|https://[A-Za-z0-9.-]{4,253}/[A-Za-z0-9._~%/?=&-]{1,160}:[A-Za-z0-9._@%-]{2,64}:[^\s:]{4,128}|http://[A-Za-z0-9.-]{4,253}/[A-Za-z0-9._~%/?=&-]{1,160}:[A-Za-z0-9._@%-]{2,64}:[^\s:]{4,128}|https://[A-Za-z0-9.-]{4,253}:[A-Za-z0-9._@%-]{2,64}:[^\s:]{4,128}|http://[A-Za-z0-9.-]{4,253}:[A-Za-z0-9._@%-]{2,64}:[^\s:]{4,128}|[A-Za-z0-9-]{1,63}\.[A-Za-z0-9.-]{2,189}:[A-Za-z0-9._@%-]{2,64}:[^\s:]{4,128}

Corroborative evidence keywords

combolist, combo list, stealer log, infostealer, credential dump, leaked passwords, logins, account takeover

Proximity: 300 characters

Should match

• john.doe@example.com:Hunter2Pass — Low-tier probe - one email/password candidate without dump context
• https://portal.example.org/login:jdoe:S3cretValue — Medium-tier probe - one service-bound URL/user/password record
• URL:LOGIN:PASSWORD https://portal.example.org/login:jdoe:S3cretValue mail.example.net:analyst:N7v!q2Lm9 — High-tier probe - dump header plus two distinct credential records
• credential dump entry admin@mail.test:P@ssw0rd! — Medium-tier email/password candidate with explicit dump context

Should not match

• john.doe@example.com — Email address alone, no colon-delimited password
• note to self: rotate the leaked passwords tomorrow — Prose containing a label and a keyword but no credential pair
• time is 12:30 and the meeting is set — Colon-delimited time/text, not a credential pair
• https://portal.example.org/login:username:password — Placeholder service triple must not enforce
• Documentation example: https://portal.example.org/login:jdoe:S3cretValue — Documentation quoting a structurally valid row must not enforce
• https://jdoe:S3cretValue@portal.example.org/login — Sibling HTTP userinfo URL is not the stealer-log URL:user:password layout

Known false positives

• URLs with embedded ports (host:port) or key/value config lines that resemble a credential pair. Mitigation: Require corroborative combolist/stealer keywords and prefer lines that appear in bulk (many similar lines) before alerting.

References

• CISA advisories on credential theft and info-stealer malware
• OWASP - credential stuffing

Collections

• Cloud Credentials & API Keys