Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,805 detections
Filters
Last updated
All Time
Detection languages
1,678
1,536
487
304
268
Contributors
834
780
764
414
306
Categories
2,347
1,137
625
565
516
Platforms
3,099
696
577
382
322
Products / Services
855
811
566
419
322
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
4,805
CVEs
17
9
8
6
6
IDS Classtypes
89
56
15
14
8
IDS Protocols
101
81
9
7
1
Detects an Active Directory password spray attack originating from a single source IP, followed closely by a user account creation event (Event ID 4720) associated with a logon from that same source IP.
Correlates an interactive MFA-satisfied user sign-in with a subsequent non-interactive or token-based successful authentication from a different IP address and country within a short time window for the same user and application. This pattern is indicative of adversary-in-the-middle (AitM) phishing attacks where session cookies or tokens are intercepted and replayed.
Detects an address whose sign-ins are mostly failures across many accounts in a short window, with scripted clients and Storm-0940 campaign addresses flagged, which is how the password spray in Microsoft's ARTEX reporting looked. It does not cover the ConnectWise application sign-ins (service principal events) or a spray spread over many addresses. The query ran without errors in a live tenant.
Detects one identity reading secrets from several Azure Key Vaults in a day beyond its own 14 day baseline, which matches the bulk secret reads Microsoft reported after the ConnectWise application compromise. It needs the CloudKeyVaultEvents table, does not flag an identity that already reads many vaults every day and cannot show whether the reads were legitimate. The query ran without errors in a live tenant.
Detects execution of Mimikatz or LSASS process memory credential theft techniques that are preceded by common discovery tools (such as nltest, net, adcmd, netexec, or kerbrute) on the same device within a 24-hour window.
Detects Microsoft 365 token replay from the Huntress token spray and replay campaign. Alerts on sign-ins from an IP new to the account (not seen on 3 or more distinct days in the 14d baseline) that match one of three behaviors: a scripted client (node or bare Mozilla/5.0 user agent with Office or Authentication Broker client IDs), Device Registration Service access (Medium-High only when corroborated by a campaign IP, scripted user agent or session IP hop, otherwise Low), or one session moving across IPs within 60 minutes. Rows are raised to High when the same new IP hits 3 or more baseline accounts in the window (token spray pattern) or matches a campaign IOC. Low Signal rows are dropped when AlertOnly = true. Does not cover MFA changes, device registration events or inbox rules.
Detects potential staging and execution of files from the Microsoft Vault directory within AppData, often associated with adversary tooling or credential theft.
Detects Kerberos service ticket principal name (SPN) enumeration or exposure events occurring shortly after the execution of common remote access tools (such as Quick Assist, AnyDesk, ScreenConnect, Atera, Zoho Assist, NetSupport, or LogMeIn) on the same device.
Detects processes accessing or enumerating multiple cryptocurrency wallet files or directories across common storage paths (e.g., Exodus, Electrum, Coinomi, Ethereum, Atomic, Guarda) within a short timeframe, which is often indicative of wallet theft or credential harvesting malware.
Detects a high volume of authentication failures followed by a successful authentication from the same source IP address against edge devices like FortiGate or Palo Alto GlobalProtect within a specific time window.
Detects the execution of two or more distinct Active Directory discovery, credential extraction, or coercion tools (such as NetExec, Kerbrute, noPac, PetitPotam, SoftPerfect Network Scanner, or Impacket scripts) on the same device within a 1-hour window.
Detects AWS OIDC role assumption by a GitHub workflow running on a ci-sync-<6 chars> branch followed within an hour by Secrets Manager reads using the same session credentials, as seen in the Gheist campaign.
Detects instances where an AOMEI-related process initiates an outbound WebDAV-style connection to a public host, followed closely by a Windows WebClient service (svchost.exe) connection to the same remote IP address.
Detects PaperCut server processes (such as pc-app.exe, pc-server.exe, or Java running PaperCut) spawning command shells or utility binaries associated with credential dumping, internal reconnaissance, or pivoting.
Detects password spraying activity against Azure Active Directory / Microsoft 365 services where a single source IP attempts to authenticate against numerous distinct user accounts with low attempt counts per account and sustained over time, while excluding successful authentication IPs.
Detects access to Chrome or Chromium-based browser Local State files (which contain encrypted keys) by a non-browser process that correlates temporally with a PowerShell process exhibiting ClickFix-style staging characteristics (hidden window, bypass execution policy, and containing a URL).
Detects an inbound public network or remote interactive logon to a device, followed within 24 hours by credential-dumping activity, and subsequently within 7 days by email data staging (creation or modification of PST, OST, EML, or MBOX files) on the same device.
Detects a suspicious sequence where a client IP performs a brute-force attack against WordPress login or XML-RPC endpoints followed by enumeration of the wp-json REST API.
Correlates per-device reads of .env secret files by utility commands (such as cat, grep, findstr) with subsequent or preceding Prisma Studio or database activity within a 30-minute window, indicating potential credential theft or unauthorized database management tool usage.
Detects when Node.js or NPM processes access sensitive credential files such as .npmrc, SSH private keys, or AWS credentials, followed by an outbound public network connection from the same device within a 15-minute window.
Detects a single non-browser process accessing the 'Web Data' files of multiple different web browser families within a short timeframe, which is indicative of credential harvesting or browser stealer activity.
Page 1 of 229