Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,805 detections
Filters
Last updated
All Time
Detection languages
1,678
1,536
487
304
268
Contributors
834
780
764
414
306
Categories
2,347
1,137
625
565
516
Platforms
3,099
696
577
382
322
Products / Services
855
811
566
419
322
MITRE Techniques
18,115
15,636
12,582
8,393
6,221
4,805
CVEs
17
9
8
6
6
IDS Classtypes
89
56
15
14
8
IDS Protocols
101
81
9
7
1
Detects the execution of known credential harvesting tools such as Mimikatz, LaZagne, and pypykatz, or the use of their specific command-line arguments. The rule includes exclusions for common security software processes and authorized testing paths.
Detects non-browser processes accessing sensitive browser-stored credential and cookie databases concurrently with access to Discord local storage, which is a common behavior of information-stealing malware (e.g., x47.c) to aggregate credentials for exfiltration.
Detects Microsoft 365 sign-in events where MFA was successfully satisfied, but the sign-in is simultaneously flagged by risk detection engines as exhibiting anomalous token or session characteristics, indicative of Adversary-in-the-Middle (AiTM) session hijacking.
Detects instances where a non-browser process accesses multiple distinct browser credential or session artifacts (such as Login Data, Cookies, or Local State) across different browser profiles in a short period. This behavior is indicative of credential harvesting activities, often associated with C2 frameworks or post-exploitation tools attempting to steal session cookies, 2FA backup codes, or saved passwords.
Detects high-concurrency brute-force attempts against Dahua Easy4IP-enabled devices targeting port 37777, identified by specific binary patterns (opcode 0xA0) in the packet payload. This indicates an automated attempt to compromise device authentication.
Detects a potential OAuth device code phishing abuse pattern where an authenticated device code sign-in is immediately followed by a new device registration or Primary Refresh Token (PRT) issuance for the same user, potentially originating from a different device or IP address.
This rule detects unauthorized processes attempting to access 'Login Data' files associated with Google Chrome or Microsoft Edge web browsers. Legitimate browser processes are excluded, so any external process attempting to read these files is potentially malicious, indicating an attempt to dump stored browser credentials.
This rule detects potential unauthorized access to sensitive information by correlating the execution of command-line tools (sed, bash, sh) with secret-related flags or file references, followed shortly by execution of cloud CLI commands that enumerate or retrieve secrets. This behavior is indicative of an attacker attempting to parse or extract sensitive data stored in local configuration files or memory, and then fetching specific secret values from a cloud secret manager.
Detects high-velocity retrieval of multiple secrets from AWS Secrets Manager using a single IAM role or session shortly after activity initiation. This behavior is indicative of automated credential harvesting, often occurring post-compromise of a host (e.g., an SSH bastion) that has been assigned a high-privilege IAM role.
Detects network traffic indicating a potential adversary-in-the-middle (AiTM) phishing proxy attempting to relay authentication requests to the legitimate Microsoft login service. The rule triggers when an external host acts as a reverse proxy for login.microsoftonline.com endpoints without being the legitimate Microsoft service itself.
Detects the loading of the 'WbElevation.dll' module associated with SectopRAT, followed by suspicious access to browser, email, or cryptocurrency wallet credential stores within a 10-minute window on the same device.
Detects the execution of the OnvifUser utility with the -u flag, a technique observed in post-exploitation scenarios on Dahua network video recorder (NVR) devices to dump cached credentials.
Detects high-concurrency brute-force attempts against Dahua Easy4IP-enabled devices targeting port 37777, identified by specific binary patterns (opcode 0xA0) in the packet payload. This indicates an automated attempt to compromise device authentication.
This rule detects various system events (including process execution and user account creation) that contain the specific string 'p2pwn' in combination with the string 'p2password'. This pattern suggests the activity involves potentially malicious credential testing, hardcoded credential usage, or suspicious account interaction activity.
This rule detects potential unauthorized access to sensitive information by correlating the execution of command-line tools (sed, bash, sh) with secret-related flags or file references, followed shortly by execution of cloud CLI commands that enumerate or retrieve secrets. This behavior is indicative of an attacker attempting to parse or extract sensitive data stored in local configuration files or memory, and then fetching specific secret values from a cloud secret manager.
This rule detects the execution of Mimikatz or the use of its common command-line arguments, which are indicative of credential dumping and post-exploitation activities. It monitors process creation events for the 'mimikatz.exe' binary or command-line patterns associated with credential theft techniques such as dumping LSASS memory, extracting passwords, or Kerberos ticket manipulation.
This rule detects potential credential stuffing attempts against a Fortinet FortiGate SSL VPN portal. It triggers when an external source performs multiple HTTP POST requests to the /remote/login endpoint within a short period, accompanied by the FortiGate-specific header, which is indicative of automated brute-force or credential stuffing activity associated with the 'FortiBleed' campaign pattern.
Detects potential password spraying activity in Azure Active Directory by identifying a single source IP address that authenticates against multiple distinct user accounts within a short time frame. The rule flags instances where there are numerous authentication attempts across many users, characterized by a low per-user failure count followed by at least one successful authentication, which is indicative of a successful password spray attempt.
Detects a single account requesting an abnormally large number of Kerberos service tickets (Event ID 4769) using weak RC4 encryption (0x17) within a short window. This pattern is characteristic of Kerberoasting attacks, where an adversary requests service tickets for offline password cracking.
Detects several potentially malicious activities related to Active Directory Certificate Services (AD CS). This includes high volumes of failed requests (potential enumeration), requests for sensitive templates (privilege escalation), and potential impersonation attempts using Subject Alternative Names (SANs). These activities are associated with AD CS abuse techniques.
This rule detects potential credential dumping attempts targeting the Local Security Authority Subsystem Service (LSASS) process. It identifies suspicious file execution based on a blocklist of known credential dumping utility hashes, unauthorized OpenProcess calls to lsass.exe with specific access rights, and the creation of process memory dump files (e.g., .dmp, .dump) correlated with an lsass.exe access event.
Page 10 of 229