Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,456
11,839
5,876
5,155
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects reuse of alternate authentication materials like tokens or cookies
This rule detects potential Pass-the-Hash (PtH) attacks by looking for multiple successful network logons (LogonType 3) using NTLM authentication for the same user from the same IP address. A count of 5 or more such events is considered suspicious.
Detects multiple failed Kerberos pre-authentication attempts (EventID 4771 with status codes 0x18 or 0x1f) from a single IP address against a target user within a short timeframe (20 attempts in 5 minutes). This pattern is indicative of a brute-force attack against Kerberos accounts.
This rule detects potential brute force attacks against Azure AD accounts by identifying users with 10 or more failed sign-in attempts due to invalid credentials within a 5-minute window. It summarizes the failure count and associated IP addresses for each user.
This rule detects when a single user principal name (UPN) attempts five or more sign-ins from the same IP address within a one-hour window, and each sign-in is flagged with a 'RiskDetail' other than 'none' but still results in a 'Success' status. This could indicate an attacker attempting to bypass security controls or an account compromise where the attacker is repeatedly trying to access the account from a consistent location, possibly with different credentials or methods, until successful.
Detects potential unauthorized browser extension installations or debugging activities by monitoring process and network events related to popular web browsers.
This rule detects multiple successful RDP logons (LogonType 10) within a one-hour window by accounts containing '$' (often machine accounts) or 'admin' (privileged accounts). This behavior can be indicative of an adversary attempting to gain remote access and potentially deploy ransomware or other malicious payloads, especially if multiple source IPs are observed.
This rule detects potential credential harvesting attempts by identifying emails that contain keywords commonly associated with phishing (e.g., 'password', 'update', 'verify' in the subject) and URLs that suggest login or account pages (e.g., 'form', 'login', 'account'). It aggregates these events from the same sender over a one-hour period and flags senders with three or more such emails.
This rule detects when a user account repeatedly (3 or more times within an hour) requests either 'SeDebugPrivilege' or 'SeImpersonatePrivilege' (Event ID 4672). This behavior can be indicative of an attacker attempting to escalate privileges or manipulate access tokens, often seen in techniques like token impersonation or debugging processes for malicious purposes.
This rule detects network traffic containing the string "/etc/sudoers" over TCP port 22 (SSH). This could indicate an attempt to modify the sudoers file for privilege escalation, as the sudoers file controls which users can execute commands with superuser privileges.
This rule detects attempts to register a new device for MFA bypass persistence by monitoring HTTP POST requests to graph.microsoft.com with a URI containing 'authentication/methods'. This activity could indicate an attacker attempting to register their own device as a trusted device to bypass multi-factor authentication in an Office 365 environment.
This rule detects network traffic indicating that reversible password encryption might be enabled in Active Directory. It specifically looks for the string "AllowReversiblePasswordEncryption" in TCP traffic destined for port 389 (LDAP). Enabling reversible password encryption stores passwords in a format that can be easily decrypted, making them vulnerable to theft if the system is compromised.
This rule detects a potential network device authentication bypass attempt via SSH. Specifically, it looks for SSH traffic (port 22) directed to the home network that contains the strings "aaa authentication" and "none" (case-insensitive). This combination suggests a configuration where authentication, authorization, and accounting (AAA) is set to 'none', which could allow unauthorized access.
This rule detects network traffic on TCP port 445 (SMB) containing the string "Notification Packages" in a case-insensitive manner, flowing to the server. This pattern is indicative of an attempt to install a password filter DLL for credential harvesting, a technique used by attackers to capture user credentials.
This rule detects attempts to modify authentication configuration via LDAP by looking for the string "msDS-SupportedEncryptionTypes" in TCP traffic destined for port 389 (LDAP). This string is associated with changes to supported encryption types in Active Directory, which could be an indicator of persistence or privilege escalation.
This rule detects Kerberos Pass-the-Ticket attacks where a Ticket Granting Service (TGS) request contains a forged Privilege Attribute Certificate (PAC). This is identified by specific byte sequences in UDP traffic on port 88, which is commonly used for Kerberos.
This rule detects attempts to enumerate password policy information, specifically the 'pwdHistoryLength' attribute, from a domain controller via an LDAP query. It looks for TCP traffic on port 389 (LDAP) where the client sends a query containing both '(objectClass=domain)' and 'pwdHistoryLength' in a case-insensitive manner.
Detects successful device code authentications specifically for the Microsoft Office application (AppId d3590ed6-52b3-4102-aeff-aad2292ab01c) that do not originate from trusted named locations. This can indicate a device code phishing attempt where an attacker has tricked a user into authenticating to a malicious application.
Detects the execution of the GitHub CLI command 'gh auth token'. This behavior was observed being used by the hijacked Bitwarden CLI npm package (TeamPCP campaign) to extract and steal active GitHub credentials from developer environments.
This rule detects potential lateral movement attempts using alternate authentication material, specifically NTLMSSP, over SMB (port 445). It triggers an alert if five or more NTLMSSP authentications are observed from a single source IP address to the home network within a 30-second window. This behavior can indicate an attacker attempting to authenticate to multiple systems using stolen credentials or hashes.
This rule detects the potential reuse of an OAuth Bearer token from different IP addresses. It monitors HTTP traffic for the 'Authorization: Bearer' header and triggers an alert if the same token is observed from more than 20 distinct destination IP addresses within a 10-second window. This behavior can indicate an attempt to bypass authentication or session management, potentially through token theft or replay.
Page 140 of 206