Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,437
11,828
5,871
5,150
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects the execution of "AdPlus.exe", a legitimate Windows SDK binary that can be abused as a Living Off The Land Binary (LOLBIN) to dump process memory (potentially including LSASS) or execute arbitrary commands. The rule specifically looks for command-line arguments indicative of these malicious uses, such as dumping process memory, using a config file, or executing inline commands.
Detects the use of 'wbadmin.exe' to recover highly sensitive files such as 'NTDS.DIT', 'SAM', 'SECURITY', and 'SYSTEM' hives. Attackers can leverage this utility to dump sensitive files that might contain credential or other sensitive information.
Detects when an attacker tries to change User Account Control (UAC) elevation request destination via the "PromptOnSecureDesktop" value. The "PromptOnSecureDesktop" setting specifically determines whether UAC prompts are displayed on the secure desktop. The secure desktop is a separate desktop environment that's isolated from other processes running on the system. It's designed to prevent malicious software from intercepting or tampering with UAC prompts. When "PromptOnSecureDesktop" is set to 0, UAC prompts are displayed on the user's current desktop instead of the secure desktop. This reduces the level of security because it potentially exposes the prompts to manipulation by malicious software.
Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive using the `wbadmin.exe` utility. Attackers can leverage `wbadmin` to dump sensitive files that might contain credentials or other sensitive information.
Detects the use of the 'Get-ADComputer' cmdlet with specific parameters or LDAP filters to identify systems configured for unconstrained delegation. This activity is often performed by adversaries during the reconnaissance phase to find targets for Kerberos-based attacks like credential theft.
This rule detects the creation, modification, or deletion of client secrets within an Entra ID (formerly Azure AD) application. While client secrets have legitimate uses, their manipulation can be a method for adversaries to establish persistence by gaining unauthorized access to an application's functionalities and data.
This YARA rule detects the Sshdinjector backdoor on Linux systems. It identifies specific byte patterns associated with the backdoor's functionalities, including killing and restarting daemons, network communication, reading the /etc/shadow file (for credential dumping), and listing running services.
Detects when a Key Management Service (KMS) decryption operation is carried out by a service account that is not in an allowlist. This behavior may indicate unauthorized access to sensitive information protected by KMS keys. The rule specifically looks for 'Decrypt' events within Google Cloud Platform (GCP) and flags any service account performing this action if it's not part of a predefined allowlist.
Yara rule that detects Sshdinjector backdoor.
Detects when an Okta user's password is reset and MFA factor(s) are deactivated or reset within a 30-minute time window. This activity may indicate that the user account has been compromised, as an attacker might reset the password and then disable MFA to maintain access.
Detects when a user grants access to a GitHub Personal Access Token (PAT) and subsequently clones a high number of non-public GitHub repositories. This behavior can indicate an adversary attempting to steal the contents of multiple GitHub repositories using an automated script or offensive tool after gaining access to a PAT.
Detects when a GitHub Personal Access Token (PAT) is created from an IP address identified as a Tor exit node. This activity is suspicious because adversaries often use Tor to anonymize their network traffic when performing malicious actions, such as establishing persistence or exfiltrating data. The creation of a PAT from a Tor IP could indicate an attacker attempting to gain persistent access to a GitHub account or repository before carrying out further actions like cloning repositories to steal data.
Detects when a secret is found in a GitHub repository. Adversaries may attempt to harvest leaked/exposed secrets to further infiltrate their target's environment, maintain access, or steal data.
Detects when an SSH deploy key is added or modified in a GitHub repository. A compromised or unauthorized deploy key could allow malicious actors to push unauthorized changes into production environments, potentially bypassing code reviews and testing procedures. This could lead to the introduction of backdoors, malware, or the exfiltration of sensitive data.
This rule detects when Single Sign-On (SSO) recovery codes are accessed (downloaded, generated, printed, or viewed) for a GitHub enterprise or organization. Adversaries may attempt to access or steal these recovery codes to maintain persistent access to the target's GitHub environment, bypassing normal authentication mechanisms.
This rule detects suspicious activity involving an initial successful authentication to Office 365, followed by a non-interactive sign-in to Azure Activity (Entra ID) from the same user and IP address, but with different session IDs, applications, and user agents. This pattern is indicative of token theft and reuse, potentially using tools like GraphRunner, where an adversary uses a stolen token to perform non-interactive actions. The rule specifically looks for a mismatch in session ID, application, and user agent between the initial interactive login and the subsequent non-interactive login, while the user and IP remain consistent. The user agent strings are specifically chosen to align with those used by the GraphRunner tool.
Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.). This technique is often used to dump LSASS memory for credential access.
Detects when the Single Sign-On (SSO) recovery codes are accessed for a GitHub enterprise or organization. An adversary may attempt to access or steal SSO recovery codes in order to maintain access to their target's GitHub environment.
Detects instances where an MSSQL service on an OpenCanary honeypot has had a login attempt using SQL Authentication. This indicates an adversary is attempting to brute-force or test credentials against the honeypot's emulated MSSQL service.
Detects instances where a MySQL service on an OpenCanary honeypot has had a login attempt. This indicates an adversary is attempting to gain unauthorized access to the honeypot's emulated MySQL service, which can be a sign of reconnaissance or credential stuffing activities.
Detects instances where an MSSQL service on an OpenCanary honeypot node has had a login attempt using Windows Authentication. This indicates an adversary is attempting to authenticate against a honeypot, which is highly suspicious.
Page 193 of 206