Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
985 detections
Filters
Last updated
All Time
Detection languages
640
105
82
64
34
Contributors
242
226
216
58
46
Categories
20,439
11,829
5,873
5,151
4,864
985
Platforms
485
405
224
192
62
Products / Services
416
384
182
109
81
MITRE Techniques
498
497
264
235
234
CVEs
4
4
4
3
3
IDS Classtypes
1
Detects potential Pass-the-Hash lateral movement by identifying NTLM network/remote-interactive logons from a single user account across three or more distinct destination hosts within a 15-minute window, correlated with the usage of common credential-dumping tools or commands on the source host.
Detects successful OAuth device code sign-in attempts where the geographic location of the authentication does not match the user's historical baseline location. This is indicative of OAuth device code phishing, where a user is tricked into approving an authentication prompt for an attacker-controlled device.
Detects successful authentication events for accounts that have been dormant for at least 90 days, correlated with suspicious activity markers such as recent failed sign-in attempts, access from an unfamiliar geographic location or ASN, or a complete absence of historical sign-in activity.
Detects potential exploitation of Active Directory Certificate Services (AD CS) misconfigurations (specifically ESC1, involving client-auth EKU and enrollee-supplies-subject). The rule correlates certificate issuance events (4886, 4887, 4888) involving sensitive templates or suspicious subject alternative name (SAN) mismatches with subsequent Kerberos PKINIT authentication (4768) events using the issued certificate.
This rule detects potential identity-led lateral movement in two scenarios: 1) A single account performing RDP authentications to multiple distinct hosts within a short time frame (RDP Fan-Out), or 2) An RDP login occurring on a host shortly after evidence of LSASS process memory access on that same host, suggesting potential credential theft followed by immediate reuse.
Detects non-interactive Microsoft Entra ID service principal or managed identity sign-in events originating from an IP address, ASN, or country that has not been historically associated with that specific service principal. This behavior may indicate the use of compromised service principal credentials or stolen access tokens from adversary-controlled infrastructure.
Detects potential misuse of SSH credentials by identifying successful SSH logins from source IP addresses that have not been observed in the previous 14 days, or successful SSH logins occurring within one hour of an authorized_keys file modification on the same host. This combination of behaviors is indicative of an adversary establishing or using persistence via SSH key manipulation.
Detects potential lateral movement by users who have recently been flagged for credential theft or infostealer activity. The rule correlates initial security alerts with subsequent Windows logon events (RDP, network/WinRM) or SMB share access, identifying users connecting to multiple distinct destinations within a 48-hour window.
Detects impossible-travel activity where a single user account authenticates successfully from multiple distinct countries or IP addresses within a short 15-minute window. This behavior is highly indicative of potential session hijacking or the concurrent use of a stolen session token by both an attacker and a legitimate user.
This rule detects potential session hijacking by correlating endpoint-based detections of known infostealer malware (e.g., Vidar, Lumma, Redline) with a subsequent cloud Identity Provider (IdP) login for the same user. The correlation specifically focuses on instances where the IdP authentication originates from an IP address different from the infected host, suggesting the use of stolen session cookies by an external actor to access corporate resources.
Detects successful Azure AD sign-in events that are flagged with a medium or high risk level and identified as anomalous by Azure AD Identity Protection. The specific combination of successful authentication alongside risk details like unfamiliar features, anonymized IP addresses, or malicious IP addresses is highly indicative of potential cloud account takeover, potentially following session token theft or infostealer activity.
Detects impossible travel authentication patterns where a user logs in from two geographically distant locations within a short time frame, while specifically filtering for sessions that reuse existing refresh or session tokens instead of performing fresh interactive authentication.
Detects anomalous lateral movement behavior where a single user account authenticates via NTLM (LogonType 3, network logon) to three or more distinct hosts within a 30-minute window, without a preceding interactive logon (LogonType 2). This pattern is a strong indicator of an adversary using captured NTLM hashes to move laterally across a Windows environment.
Detects the creation of a remote service (Event ID 7045 or 4697) on a Windows host shortly after a remote SMB logon. The detection specifically looks for service binary paths associated with well-known lateral movement tools like PsExec (PSEXESVC), the ADMIN$ network share, or randomized executable names within the Windows Temp directory, which are common artifacts left by tools such as Impacket psexec.py and CrackMapExec.
Detects anomalous Kerberos service ticket (TGS) requests or successful logons where the corresponding Ticket Granting Ticket (TGT) request (Event ID 4768) is absent within the monitored window. This pattern is a primary indicator of offline-forged Kerberos tickets, such as those generated by Mimikatz, which bypass legitimate KDC interaction for ticket issuance.
Detects anomalous lateral movement behavior characterized by an account performing multiple NTLM authentication events (Logon Type 3) across distinct hosts within a short time window, specifically where Kerberos pre-authentication is absent. This pattern is frequently observed in Pass-the-Hash (PtH) attacks where attackers utilize stolen NTLM hashes to move laterally.
Detects NTLM network logons (LogonType 3 or 9) which often result from a host resolving an attacker-supplied UNC path (e.g., \host
esource) during forced authentication attacks. This rule monitors Windows Security Event ID 4624 to identify incoming NTLM-based network authentication requests, excluding local system logons.
Detects potential lateral movement or compromised account use where a single user identity authenticates to multiple distinct cloud or administrative resources within a short time window (15 minutes). The rule uses a threshold of six or more unique applications or resources to identify anomalous patterns typical of reconnaissance or mass resource access often associated with stolen credentials. Administrative, service, and automation-related accounts are excluded to minimize noise.
This rule detects potential lateral movement by identifying processes spawned via WMI (e.g., wmic.exe, WmiPrvSE.exe) or PowerShell Remoting (WinRM, Invoke-Command, Enter-PSSession) that occur shortly after a successful network or remote interactive logon on the same host.
This rule detects potential brute force or account compromise attempts by identifying user accounts that have successfully authenticated or initiated authentication events from two or more distinct IP addresses within the observed time window. It monitors Windows Event IDs 4624 (Successful Logon), 4648 (Logon attempted using explicit credentials), and 4776 (The domain controller attempted to validate the credentials for an account).
Detects sign-in activity using refresh tokens from device details (deviceId, browser, OS) that have not been previously observed for the user. This pattern is indicative of session token theft, often associated with Adversary-in-the-Middle (AiTM) phishing kits where attackers replay stolen session or refresh tokens to bypass multi-factor authentication.
Page 5 of 47