Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
This rule detects the creation of files with specific naming conventions and extensions that are indicative of exported or stolen DPAPI backup keys and certificates. These patterns are commonly associated with tools like Mimikatz and DSInternals, which adversaries use to extract credentials and cryptographic material from Windows systems. The rule looks for filenames containing "ntds_capi_", "ntds_legacy_", or "ntds_unknown_" and ending with ".cer", ".key", ".pfx", or ".pvk".
Detects suspicious processes based on name and location that access the Windows Credential Manager and Vault. This activity can be indicative of credential stealing, such as that performed by Mimikatz's "dpapi::cred" function.
This rule detects attempts by uncommon applications to access Windows Data Protection API (DPAPI) Master Keys. Such access can indicate credential theft, for example, through tools like Mimikatz's "dpapi::masterkey" function. The rule specifically looks for file access requests to the DPAPI master key directories for both system and user accounts, while filtering out access from common system and program files locations to reduce false positives.
This rule detects the execution of various Windows-based hacktools by matching their import hash (imphash). This method allows for detection even if the tool's filename has been changed. The rule includes imphashes for tools such as PetitPotam, JuicyPotato, RoguePotato, Pwdump, Cobalt Strike beacons, PPLDump, NanoDump, HandleKatz, DripLoader, UACMe, WCE, Sliver Stagers, Dumpert, SysmonEnte, SysmonQuiet, ShaprEvtMute Hook, Forkatz, PPLKiller, Backstab, Forensia, EDRSandBlast, and EDRSilencer.
This rule detects the execution of 'esentutl' with the '/p' parameter. This command-line utility is used for database utilities, and its use with '/p' (repair mode) can be leveraged by adversaries to access or repair Extensible Storage Engine (ESE) databases, including the NTDS.dit file which contains Active Directory credential information. This technique has been observed in use by threat actors like Conti ransomware and Trickbot to gather credentials or other sensitive information from compromised systems.
Detects the registration of a new ODBC driver where the driver's DLL is located in a potentially suspicious or non-standard system directory. Adversaries may use this technique to establish persistence or facilitate credential access by registering malicious ODBC drivers.
Detects when Kubernetes Secrets are created, modified, or deleted. This activity is critical to monitor as secrets often contain sensitive information like API keys, passwords, and OAuth tokens. Unauthorized modification or deletion of these secrets could lead to credential compromise, unauthorized access, or denial of service within a Kubernetes cluster.
Detects the use of the PowerShell cmdlet 'Get-StorageDiagnosticInfo' with the '-IncludeLiveDump' parameter to dump the live memory of a Windows machine. This technique can be used by adversaries to extract sensitive information, including credentials, from memory.
Detects file access requests to the Windows Credential History File by an uncommon application. This can be a sign of credential stealing, for example, the usage of Mimikatz's "dpapi::credhist" function. The rule filters out common legitimate system processes and applications to reduce false positives.
Detects file access requests to Windows Outlook Mail data files by uncommon processes. This could indicate a potential attempt to steal credentials or sensitive information from Outlook mailboxes. The rule requires significant baselining to reduce false positives.
Detects attempts by uncommon processes to access sensitive Microsoft Teams files, specifically those containing authentication tokens (leveldb) and cookies. This rule aims to identify potential credential theft or unauthorized access to user sessions within Microsoft Teams.
This rule detects the use of 'sc.exe' to query and enumerate services, specifically looking for the 'termservice'. Attackers often use 'sc.exe' to gather information about running services on a system, which can help them identify potential attack vectors or sensitive services. The detection focuses on the execution of 'sc.exe' with the 'query' command and the specific service 'termservice'.
This rule detects attempts by uncommon applications to access cryptocurrency wallet files. It specifically looks for file access requests to common cryptocurrency wallet paths for Ethereum, Ethereum Classic, Monero, Bitcoin, BitcoinABC, BitcoinSV, DashCore, DogeCoin, Litecoin, Ripple, and Zcash. The rule filters out access by common system processes, applications installed in standard Program Files directories, and Windows Defender components to reduce false positives. This activity could indicate an attempt to steal cryptocurrency wallets.
Detects file access requests to potentially sensitive files hosted on the Windows Sysvol share by applications that are not commonly expected to access these files. This can indicate an attempt to gather credentials or configuration details from Group Policy Objects.
This rule detects attempts by uncommon processes to access sensitive files associated with Chromium-based browsers. These files typically contain user data such as cookies, browsing history, and web data, which could be leveraged for credential access or other malicious activities if exfiltrated. The rule specifically targets file paths related to Chromium's user profile data and filters out access by common system processes and known legitimate applications like Windows Defender to reduce false positives.
Detects failed logon attempts from clients with external network IP to an MSSQL server. This can be a sign of a bruteforce attack.
Detects file access requests to browser credential stores by uncommon processes. This could indicate a potential attempt at credential stealing. This rule requires heavy baselining before usage.
Detects strong indicators of a successful device code phishing attack. This rule correlates email events containing Microsoft device login URLs with subsequent Microsoft Entra ID authentication attempts that result in a specific error code (50199 or 0), indicating the user was prompted to confirm the application. The time window for correlation is set to 16 minutes, accounting for the typical 15-minute expiration of device codes.
Detects attempts to access the "unattend.xml" file, which can contain sensitive credentials used during the unattended Windows installation process. Attackers may target this file to harvest credentials.
Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access attempts. Adversaries may attempt to access browser credential storage to extract sensitive information such as usernames and passwords or cookies. This behavior is often commonly observed in credential stealing malware.
Detects the creation of files with specific naming patterns, such as '\sessionresume_[a-zA-Z]{8}$', which are known to be used by the Impacket toolkit, particularly its secretsdump.py module. This activity often indicates an attempt to dump credentials from a compromised system.
Page 183 of 206