Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
33 detections
Filters
Last updated
All Time
Detection languages
15
10
3
2
1
Contributors
7
5
4
3
2
Categories
12
9
7
6
5
Platforms
16
10
6
4
3
Products / Services
9
5
3
3
2
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
5
1
IDS Classtypes
1
IDS Protocols
1
Detects the execution of the TruffleHog secret scanning tool. This tool is often used by attackers to find sensitive information like credentials in various data sources (filesystems, Git repositories, cloud storage, etc.). This rule identifies the process creation of TruffleHog and categorizes the type of scan being performed. It includes exclusions for legitimate CI/CD environments or security scanners.
This detection identifies a large-scale phishing campaign utilizing legitimate SharePoint Personal (OneDrive) infrastructure from external organizations to deliver malicious lure documents. By sending notifications via the official no-reply@sharepointonline.com address, the attackers bypass many reputation-based filters and exploit user trust in the Microsoft 365 ecosystem.
This detection identifies a large-scale phishing campaign utilizing legitimate SharePoint Personal (OneDrive) infrastructure from external organizations to deliver malicious lure documents. By sending notifications via the official no-reply@sharepointonline.com address, the attackers bypass many reputation-based filters and exploit user trust in the Microsoft 365 ecosystem.
This rule detects activity associated with TruffleHog, an open-source tool used for finding credentials and sensitive data, within cloud audit logs. It specifically looks for the 'trufflehog' string in the user_agent field, indicating that the tool was used to interact with cloud resources.
This rule detects sign-in attempts to Azure AD where the User-Agent string contains 'TruffleHog'. TruffleHog is an open-source tool used for finding sensitive data like credentials in various data sources, including code repositories. Its presence in sign-in logs could indicate an adversary or security researcher attempting to verify leaked credentials or discover exposed secrets related to Azure AD service principals.
AWS SES Email Enumeration Detection
Cortex XDR
Detects enumeration of AWS SES email identities and sending quotas. This activity can indicate an attacker performing reconnaissance before launching phishing or Business Email Compromise (BEC) attacks. The rule identifies multiple distinct SES operations related to identity and quota checks performed by a single user within a two-hour window.
KQL Query
KQL Query
KQL Query from file: Microsoft Entra Identity Attack Threat Detection
This analytic detects an unusual number of Kerberos Ticket Granting Ticket (TGT) requests for non-existing users from a single source endpoint. It leverages Windows Event ID 4768 and identifies anomalies using the 3-sigma statistical rule. This behavior is significant as it may indicate an adversary performing a user enumeration attack against Active Directory. If confirmed malicious, the attacker could validate a list of usernames, potentially leading to further attacks such as brute force or credential stuffing, compromising the security of the environment.
Detects exploitation attempts targeting CVE-2018-15473 in OpenSSH, specifically looking for a characteristic error message generated during the pre-authentication phase when an attacker attempts to enumerate valid usernames.
Indicates that the user's valid credentials have been leaked.
Page 2 of 2