Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
52 detections
Filters
Last updated
All Time
Detection languages
44
6
2
Contributors
52
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
20
20
11
4
4
Products / Services
13
8
7
5
5
MITRE Techniques
21
12
12
5
5
CVEs
9
1
1
Detects a single device requesting Entra ID access/refresh tokens on behalf of multiple distinct users in a short window, indicative of Primary Refresh Token (PRT) theft used to impersonate other users, as CISA's red team did against an application owner.
Detects non-administrative access querying SCCM to enumerate user-device relationships, used by CISA's red team to identify which workstations belonged to high-value targets.
Detects ESC1-style ADCS certificate enrollment where a requester supplies an arbitrary SAN on a misconfigured template (CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT), enabling impersonation of any account. CISA's red team used this to certify a rogue machine account.
Detects authentication to a web application using default/built-in account credentials followed by outbound mail sent from an internal address — the technique CISA's red team used to send phishing email from a trusted internal identity.
Detects newly granted or consented Microsoft Entra ID application permissions exceeding baseline, a weakness CISA's red team exploited to escalate privileges and reach cloud resources.
Detects mass LDAP enumeration queries consistent with a modified BloodHound collector scraping AD users, computers, groups, and GPO/ACL data — customized by CISA's red team to evade static EDR signatures.
Detects a DCSync (directory replication) request targeting the krbtgt account, which yields the key material needed to forge Golden Tickets and impersonate any domain user. CISA's red team DCSynced krbtgt early in its Active Directory compromise (AA26-237A).
Detects service-principal/workload-identity sign-ins occurring without an enforced Conditional Access policy — a gap CISA's red team exploited for unauthorized cloud access.
Detects computer-account creation (Event ID 4741) by a non-administrative user, indicative of abuse of the default Machine Account Quota to join unauthorized machine accounts for privilege escalation, as exploited by CISA's red team.
Detects interactive sign-in by an Entra Connect/AAD Connect sync service account (Sync_ prefix), which should only authenticate non-interactively. CISA's red team compromised a hybrid sync account to pivot from on-prem AD into cloud resources.
Detects email from a new hire (within 30 days of hire date) combining personal-crisis pretext language with an explicit request to use a personal or unmanaged device, corroborated by a non-compliant or untrusted device sign-in, consistent with PurpleDelta's device-substitution social-engineering pattern.
Detects a non-browser process reading browser session-cookie databases or 2FA/authenticator extension local storage across 200+ targeted apps, consistent with OnyxC2's MFA-bypass and account-takeover capability.
Detects email communications from a recently-created account (within 60 days of account creation) requesting redirection of payroll or business payments to a personal bank account under a fabricated 'bank account under review' pretext, consistent with PurpleDelta payment-fraud tradecraft.
Detects an applicant identity submitting an abnormally high volume of job applications across many companies within a rolling window, corroborated by resume or portfolio content reused across multiple applicant identities — consistent with PurpleDelta fabricated-persona application tempo.
Detects a single source device or IP maintaining genuinely time-overlapping sign-in sessions under two or more distinct user identities, excluding known shared/kiosk devices and shared VPN egress points, consistent with a single PurpleDelta operator working multiple jobs simultaneously.
Detects logons using built-in default accounts (Administrator, Guest) or domain-admin accounts occurring outside an established baseline (new host, unusual time, first-ever interactive logon), repeated at least twice and excluding newly-provisioned accounts within their grace period or approved break-glass accounts.
Detects a credential-phishing email linking to a spoofed Microsoft device-code login flow (deviceaddcredential.srf) from a sender/recipient domain mismatch, or delivery of the associated known malicious attachment hash.
Detects sign-ins with impossible browser/OS combinations and Outlook-labeled sign-ins presenting non-native user agents, consistent with Storm-2755 AiTM session token replay and impersonation.
Detects RDP-based lateral movement, including pivots into VDI, AD, and authentication infrastructure, excluding known bastion/jump hosts and flagging sessions from atypical source workstations or off-hours timing.
Detects an account making repeated Microsoft Graph API user search requests for payroll/HR display names via an axios HTTP client against a specific ApplicationId, consistent with Storm-2755 payroll-personnel reconnaissance.
Detects OS credential dumping of the Active Directory NTDS.dit database via ntdsutil, VSS-based extraction, or Impacket's secretsdump.py, excluding approved AD backup jobs and accounts.
Page 1 of 3