Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,456
11,839
5,876
5,155
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects when a Managed Identity successfully authenticates via the Azure Instance Metadata Service (IMDS) and subsequently performs administrative or enumeration actions within a short timeframe. This pattern can indicate an attacker has compromised a resource (e.g., a Virtual Machine) and is using its Managed Identity to move laterally or access other resources within the Azure environment. The rule correlates successful IMDS-based sign-ins with subsequent activities such as running commands on virtual machines, or listing/getting secrets and keys from Key Vaults, or other general administrative/alert-generating activities.
Detects when a VM Run Command is executed successfully, followed by the VM's Managed Identity authenticating to Azure Resource Manager. This pattern may indicate an attacker using Run Command to steal MI tokens for lateral movement.
Detects privileged credential retrieval from Privileged Access Management (PAM) solutions via PowerShell, including CyberArk AIM, Thycotic, HashiCorp Vault
Detects potential lateral movement attempts within Azure by a Service Principal (Managed Identity) executing 'runCommand' or other compute operations on virtual machines. This activity could indicate an attacker abusing a compromised Managed Identity to gain access to and control other resources.
Detects attempts to access or exfiltrate the Active Directory database (NTDS.dit) using the 'print.exe' utility. This specific technique was observed in post-exploitation activities following the compromise of SolarWinds Web Help Desk servers.
Detects the creation of specific files ('result', 'result.kerb') in common user folders. These filenames are known artifacts of tools like GoSecretsDump used to decrypt the NTDS.dit database, a technique observed in Muddled Libra's playbook after they exfiltrate the database from a Domain Controller.
Detects the use of 'dscl . authonly' to validate user passwords, a technique
used by the SHub Stealer malware to verify credentials before exfiltration.
The malware typically executes this command from a shell or AppleScript
interpreter.
used by the SHub Stealer malware to verify credentials before exfiltration.
The malware typically executes this command from a shell or AppleScript
interpreter.
Detects the execution of wbadmin.exe with command line arguments used to back up or restore sensitive Active Directory database (NTDS.dit) or registry hives (SYSTEM). This is a common technique for credential dumping.
Detects processes other than known Microsoft identity components accessing sensitive authentication token directories (IdentityCache or OneAuth). Threat actors use this technique to steal session tokens to bypass MFA and maintain persistent access to cloud environments.
Detects network connections to the typosquatted domain nexsnield.com, which is used by the malicious uBlock Origin Lite extension to track installations and correlate activity.
Detects TruffleHog credential validation via sts:GetCallerIdentity - initial access indicator for AWS WorkMail phishing campaigns
Detects potential exploitation of CVE-2026-25253, a 1-click RCE in OpenClaw, by identifying the 'gatewayUrl' query parameter in HTTP traffic. This parameter is used to hijack authentication tokens.
Detects Windows logon events where the account name starts with 'WAC_' and belongs to a domain outside of the organization's tenant. This pattern is a key indicator for CVE-2026-20965 exploitation, where an attacker uses a forged token from an external tenant to gain unauthorized access to a Windows Admin Center (WAC) managed machine.
This rule detects successful sign-ins to Azure Active Directory (AAD) from IP addresses outside of New Zealand and Australia, where the User-Agent string matches a list of known suspicious User-Agents. It filters out many legitimate User-Agents to reduce false positives, including those from Microsoft applications, mobile devices, and common system services. The rule aims to identify potential unauthorized access attempts or compromised accounts leveraging unusual client software or scripts.
Detects the modification of registry keys to disable Windows Defender Credential Guard. Disabling this security feature can expose credentials to theft and is a common precursor to lateral movement.
Detects Okta MFA device enrollment or life cycle changes that occur shortly after a successful authentication or password reset for the same user. This pattern is a strong indicator of a post-vishing account takeover, as seen in ShinyHunters campaigns.
This rule detects a correlated attack chain involving LDAP Service Principal Name (SPN) enumeration followed by Kerberoasting activity. It identifies an actor performing LDAP queries for SPNs, then links that actor to subsequent Kerberos Ticket-Granting Service (TGS) requests for those service accounts within a defined time window. The rule specifically looks for a minimum number of unique service accounts targeted to trigger an alert, indicating a potential Kerberoasting attack.
This rule detects sign-in attempts to Azure Active Directory (AAD) service principals where the User-Agent string contains "TruffleHog". TruffleHog is an open-source tool used for finding sensitive data (like credentials) in various data sources. Its presence in AAD sign-in logs, especially for service principals, could indicate an attempt to scan for or verify leaked secrets or credentials associated with service accounts.
This is a credential after-hours logon activity automation, whenever an employee that's not supposed to log on to the core banking system after hours do so, this will trigger and alert the SOC team.
Detects a process reading a .env file, which often contains sensitive credentials like API keys. This is often the first step of a data exfiltration pattern where the credentials are then sent to an attacker-controlled server. This behavior was observed in the malicious 'rankaj' OpenClaw skill. This rule should be correlated with subsequent network activity from the same process to a rare destination.
Detects the use of lifecycle hooks in `.devcontainer/devcontainer.json` files to execute potentially malicious commands. Adversaries can abuse hooks like `postCreateCommand` or `postStartCommand` in development environments like GitHub Codespaces to automatically run scripts upon container creation. This can be used to exfiltrate secrets, such as GitHub tokens, or establish further access.
Page 158 of 206