Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
985 detections
Filters
Last updated
All Time
Detection languages
640
105
82
64
34
Contributors
242
226
216
58
46
Categories
20,443
11,831
5,875
5,151
4,864
985
Platforms
485
405
224
192
62
Products / Services
416
384
182
109
81
MITRE Techniques
498
497
264
235
234
CVEs
4
4
4
3
3
IDS Classtypes
1
Detects Kerberoasting attempts by identifying suspicious Ticket Granting Service (TGS) requests (Event ID 4769) for the 'krbtgt' service or other services where the ticket encryption type is RC4 (0x17) or older/weaker encryption types (0x18), especially when these requests are not preceded by a corresponding Ticket Granting Ticket (TGT) request (Event ID 4768).
Detects instances where a user successfully authenticates using Multi-Factor Authentication (MFA) from one location, followed by a Single-Factor Authentication (SFA) logon from a different location within a 10-minute window. This behavior is indicative of potential session hijacking or session cookie theft where an attacker reuses an authenticated session or manipulates the authentication flow to bypass MFA requirements.
Detects unauthorized access and command execution associated with MSP service accounts. The rule triggers on successful SSH authentication using specific service account names (e.g., egnyteservice) followed by the execution of interactive shells under those same service account contexts, which is indicative of potential lateral movement or compromise in downstream environments.
Detects a single source IP address initiating Remote Desktop Protocol (Logon Type 10) connections to three or more distinct computer destinations within a 10-minute window. This behavior is indicative of lateral movement or internal network scanning activity.
This rule detects potential brute force attacks or username enumeration by identifying 5-minute windows where multiple distinct user accounts trigger a high volume of failed logon events (Event ID 4625). It summarizes failures by timeframe and flags scenarios where more than 5 unique usernames failed to authenticate, categorizing the severity based on the number of accounts affected.
Detects failed Windows logon attempts (Event ID 4625) where the supplied username conforms to typical password complexity requirements (minimum 10 characters, including uppercase, lowercase, digit, and special character). This behavior often indicates that a user has mistakenly entered their password into the username field, which may expose credentials in cleartext logs and suggests a potential security awareness issue or an attempt to bypass authentication.
This rule detects a suspicious volume of file copy activity (over 200 files) to a non-local drive (potentially a removable/USB device) occurring within 24 hours of an account being deleted or disabled on the same host. This pattern may indicate an insider threat or an adversary attempting to exfiltrate sensitive data shortly before or after losing authorized access to an account.
This rule detects a suspicious volume of file copy activity (over 200 files) to a non-local drive (potentially a removable/USB device) occurring within 24 hours of an account being deleted or disabled on the same host. This pattern may indicate an insider threat or an adversary attempting to exfiltrate sensitive data shortly before or after losing authorized access to an account.
Detects successful authentication for a user account immediately following a password change event. This pattern is indicative of a compromised PAM (Pluggable Authentication Modules) component or similar authentication backdoor that utilizes a hardcoded 'master' password to maintain access, bypassing credential rotation. This behavior is associated with the threat actor Velvet Ant (Operation Highland).
Detects an internet-facing host in the DMZ that receives an inbound connection from an external non-RFC1918 address and subsequently authenticates to an internal RFC1918 host within a one-hour window. This behavior is indicative of a compromised DMZ host being used as a pivot point for lateral movement into the internal network.
This rule detects successful or failed logon attempts originating from IP addresses identified by threat intelligence as associated with botnets, command and control (C2) infrastructure, or proxies. The rule specifically looks for 'LogOn' or 'FailedLogOn' activity types where the source IP's threat intelligence indicator type is 'Botnet', 'C2', or 'Proxy', and where activity insights are available.
Detects a successful authentication event (including MFA success) immediately followed by another successful authentication for the same user account from a different IP address or user agent, within a 10-minute window. This behavioral pattern is often indicative of session hijacking or adversary-in-the-middle (AiTM) phishing attacks where an attacker reuses a session token obtained from a victim.
This rule identifies endpoints identified as EMS or FortiClient that exhibit an unusually high number of login events (greater than 20) or a high number of unique accounts logging in (greater than 10) within a specific timeframe. This behavior may indicate unauthorized access attempts, automated password spraying, or potential lateral movement activity directed at remote access infrastructure.
Detects high-frequency SMB (Logon Type 3) authentication events targeting Domain Controllers, specifically involving suspicious or generic accounts such as 'ANONYMOUS LOGON', 'Guest', empty usernames, or machine accounts. This behavior is indicative of network reconnaissance, session enumeration, or brute-force attempts targeting the domain.
Detects Kerberoasting attempts by identifying suspicious Ticket Granting Service (TGS) requests (Event ID 4769) for the 'krbtgt' service or other services where the ticket encryption type is RC4 (0x17) or older/weaker encryption types (0x18), especially when these requests are not preceded by a corresponding Ticket Granting Ticket (TGT) request (Event ID 4768).
Detects potential Windows privilege escalation attempts where a user account is assigned the SeImpersonatePrivilege and subsequently executes known exploitation tools (e.g., Potato-family exploits) within a short window. This pattern often indicates an attempt to escalate to SYSTEM privileges by abusing token impersonation vulnerabilities.
Detects potential lateral movement by the Akira ransomware group. The rule triggers when a Windows interactive RDP logon (LogonType 10, NTLM V2) occurs on a target host while the source host simultaneously exhibits process execution of the 'AdgNsy.exe' file, which is a known agent associated with Akira's command-and-control infrastructure.
This rule detects interactive logons (LogonType 10) where a single account from the same domain logs into multiple distinct devices. This could indicate an attacker using compromised credentials to move laterally within the network or access multiple systems.
Detects potential Adversary-in-the-Middle (AiTM) phishing activity by identifying successful user sign-ins from a new, historically unseen IP address occurring within 30 minutes of a legitimate sign-in from a known IP, indicating the potential replay of a stolen session or refresh token.
This rule detects potentially malicious credential abuse patterns, such as credential stuffing or brute force attacks, originating from external IP addresses against edge appliance VPN or administrative interfaces. It identifies activity by correlating a high volume of failed authentication attempts followed by a successful login from the same external IP address.
This rule detects potential lateral movement activities by monitoring Windows Event Logs for suspicious network logons combined with service installations typical of post-exploitation tools like Impacket (psexec.py, wmiexec.py, smbexec.py). It flags service names and paths that match known tool patterns, specifically looking for high-frequency lateral movement attempts within a 30-minute window, including specific command-line indicators in service image paths.
Page 32 of 47