Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,456
11,839
5,876
5,155
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects download of password wordlists or hash dumps for offline cracking
This rule detects an unusually high number of process creations using 'RunAs' within a one-hour window by a single user. A count of 5 or more 'RunAs' commands within an hour could indicate an attempt at privilege escalation or lateral movement, potentially by an attacker trying to execute commands with different user contexts.
This rule detects attempts to perform SID History Injection via DCSync Replication. Specifically, it looks for TCP traffic on port 445 (SMB) directed to the home network, containing the string "DsAddSidHistory" case-insensitively. This activity is indicative of an attacker attempting to add a Security Identifier (SID) from another account to a target account's SIDHistory attribute, often as part of a privilege escalation technique like DCSync attacks, to gain unauthorized access or maintain persistence within an Active Directory environment.
This rule detects when the 'sIDHistory' attribute is added to a domain account. This is a common technique used in privilege escalation, particularly in Active Directory environments, where an attacker adds the SID of a highly privileged account (like a Domain Admin) to a compromised account's sIDHistory. This grants the compromised account the privileges of the added SID without changing its primary SID.
This rule detects attempts to modify Identity Provider authentication settings within Microsoft Graph. Specifically, it looks for HTTP PATCH requests to the 'authentication' endpoint on 'graph.microsoft.com'. This activity could indicate an attacker attempting to alter authentication mechanisms, potentially for persistence or to facilitate further access.
This rule identifies successful device code authentications using the Microsoft Authentication Broker application (AppId '29d9ed98-a469-4536-ade2-f981bc1d605e') targeting Microsoft Graph (ResourceIdentity '00000003-0000-0000-c000-000000000000'). It specifically looks for these authentications originating from untrusted network locations. This activity is highly anomalous and can indicate an attacker generating Primary Refresh Tokens (PRTs) via device code phishing.
This rule detects potential brute force attacks against Active Directory accounts by identifying multiple failed login attempts (EventID 4625) from the same IP address to the same account within a short time frame (10 failed attempts within 10 minutes).
This rule detects multiple unauthorized access attempts (5 or more within an hour) to sensitive Active Directory objects such as 'Admin', 'krbtgt', or 'Domain Admins'. It leverages Windows Security Event ID 4662, which indicates an operation was performed on an object, and filters for specific sensitive object names. The rule then groups these attempts by object, IP address, and user, alerting when a threshold of attempts is met.
This rule detects potential Kerberoasting attacks by identifying a high number of Kerberos Ticket-Granting Service (TGS) requests (EventID 4769) for Service Principal Names (SPNs) that are encrypted with RC4 (indicated by TicketOptions containing '0x40810000'). A threshold of 15 or more TGS requests from a single IP address for a target user is used to flag suspicious activity.
Detects the execution of the 'search:' or 'search-ms:' URI handlers utilizing the 'crumb=location:' parameter pointing to UNC path. This behavior forces outbound NTLM authentication and can be abused to leak Net-NTLMv2 hashes, exploiting an unpatched vulnerability similar to CVE-2026-33829 in the Snipping Tool.
Based off of rule https://systemtwosecurity.com/rules/019e8d90-1f73-76f9-8f67-d534a63a37ec
Based off of rule https://systemtwosecurity.com/rules/019e8d90-1f73-76f9-8f67-d534a63a37ec
Detects registration of malicious SSP DLLs for credential interception
This rule detects potential credential harvesting attempts by identifying emails that contain keywords commonly associated with phishing (e.g., 'password', 'update', 'verify' in the subject) and URLs that suggest login or account pages (e.g., 'form', 'login', 'account'). It aggregates these events from the same sender over a one-hour period and flags senders with three or more such emails.
This rule detects SMB authentication attempts that might be indicative of a 'Pass-the-Hash' attack (ATT&CK T1550.002). It specifically looks for NTLMSSP (NT LAN Manager Security Support Provider) traffic on TCP port 445 (SMB) where the NTLM authentication message contains a specific sequence of null bytes, which can be characteristic of a hash being passed instead of a cleartext password.
This rule detects attempts to exploit a vulnerability in the Windows Search URI handler that can lead to NTLM credential leaks. It specifically looks for network events where the `RemoteUrl` contains 'search:' or 'search-ms:' along with parameters like 'query=' or 'crumb='. This indicates an attempt to trigger the Windows Search functionality with crafted URI parameters, which could force the system to authenticate to an attacker-controlled server using NTLM.
This rule detects attempts to access or exfiltrate DPAPI (Data Protection API) credentials stored in the 'CREDHIST' folder. Specifically, it looks for file events within the `\Microsoft\Protect\CREDHIST` folder where the initiating process is either `dpapisnoop.exe` or `powershell.exe`. `dpapisnoop.exe` is a known tool for DPAPI credential extraction, and PowerShell can also be used for similar purposes.
Detects anomalous processes targeting modern AI developer credential files and configuration files for tools like Claude, Gemini, and Cursor, a behavior exhibited by IronWorm.
This rule detects suspicious access to the UniFi OS JWT secret file (jwt.yaml) by processes other than the legitimate UniFi core components. It monitors for direct file access events (read, copy) and command-line executions that target the jwt.yaml file. This activity could indicate an attempt to extract sensitive credentials, potentially leading to unauthorized access or privilege escalation within the UniFi environment.
Detects a spike in successful operations related to Azure Storage Account Keys by a single caller within a one-hour window. This could indicate an adversary attempting to enumerate, access, or exfiltrate storage account keys, or a legitimate user performing multiple key management activities.
This rule detects a high volume of access attempts (10 or more within an hour) by a single user to sensitive system directories such as 'Admin' or 'System32'. This behavior could indicate an adversary performing file and directory discovery, attempting to access sensitive files, or staging for further malicious activity.
This rule detects multiple HTTP requests to 'iam.amazonaws.com' with the URI containing 'DeleteAccessKey'. This activity, especially when occurring frequently (5 times in 30 seconds from the same source), could indicate an attempt to revoke cloud account access keys, potentially as part of a lockout impact attack.
This rule detects potential banking web inject form overlays by looking for specific keywords in HTTP response data. It triggers when an HTTP response contains 'account_number', 'routing_number', and 'XMLHttpRequest' (all case-insensitive). This combination of keywords suggests an attempt to inject malicious forms into a legitimate banking website to steal credentials or financial information.
Page 138 of 206