Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,805 detections
Filters
Last updated
All Time
Detection languages
1,678
1,536
487
304
268
Contributors
834
780
764
414
306
Categories
2,347
1,137
625
565
516
Platforms
3,099
696
577
382
322
Products / Services
855
811
566
419
322
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
4,805
CVEs
17
9
8
6
6
IDS Classtypes
89
56
15
14
8
IDS Protocols
101
81
9
7
1
This rule identifies when a key within Azure Key Vault is modified or deleted. This includes operations such as updating, creating, importing, recovering, restoring, deleting, backing up, or purging keys. Monitoring these actions is crucial as compromise or unauthorized modification/deletion of cryptographic keys can lead to significant security incidents, including data compromise, loss of access to encrypted resources, or disruption of services relying on these keys.
Detects the creation or update of Active Directory Certificate Services (AD CS) certificate templates that are configured with risky Extended Key Usages (EKUs) and allow the enrollee to supply the subject. This combination can be exploited for privilege escalation and credential access, as described in the 'Certified Pre-Owned' whitepaper, by allowing an attacker to request certificates with arbitrary subject names, potentially impersonating privileged accounts.
This rule detects the transfer of sensitive files containing credential data over network shares. It specifically looks for filenames or paths commonly associated with credential dumping, such as 'mimidrv', 'lsass', 'windows\minidump\', 'hiberfil', 'sqldmpr', 'sam', 'ntds.dit', and 'security'. This activity often indicates an attempt to exfiltrate credentials after they have been dumped from a system.
Detects Kerberos Ticket-Granting Service (TGS) requests that utilize RC4 encryption. This is often indicative of Kerberoasting attacks, where adversaries request service tickets for Service Principal Names (SPNs) and then attempt to crack the RC4-encrypted hash offline to obtain plaintext credentials. The rule specifically excludes requests from computer accounts (service accounts ending with '$') to reduce false positives.
This rule detects the creation or update of Active Directory Certificate Services (AD CS) certificate templates that include the 'CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT' flag. This flag allows a user to specify the subject name in a certificate request, which can be abused for privilege escalation or credential access, particularly in scenarios involving misconfigured AD CS environments as described in the 'Certified Pre-Owned' research.
This rule detects Mimikatz DCSync activity by monitoring Windows Security Event ID 4662. Specifically, it looks for access attempts to replicate directory changes (identified by specific GUIDs) with an AccessMask of '0x100'. To reduce false positives, it filters out activity from 'Window Manager' and service accounts starting with 'NT AUT', 'MSOL_', or ending with '$'.
This rule detects suspicious user agent strings commonly used by various hacking tools, including vulnerability scanners, brute-force tools, and SQL injection tools, within proxy logs. The rule identifies specific strings indicative of tools like Arachni, Hydra, DirBuster, SQLMap, and others, which are often employed during reconnaissance, initial access, and credential access phases of an attack.
This rule detects the execution of common network sniffing tools, specifically 'tcpdump' or 'tshark', when they are invoked with arguments indicating an attempt to capture network traffic from a specific interface. The rule looks for the '-c' argument (for count) and the '-i' argument (for interface) in the command line, which are typical indicators of active network sniffing.
Detects suspicious access to Microsoft Teams application's authentication tokens and local storage, which may contain sensitive credentials. This rule specifically looks for Event ID 4663 (Object Access) where the accessed object path contains '\Microsoft\Teams\Cookies' or '\Microsoft\Teams\Local Storage\leveldb', and the accessing process is NOT the legitimate 'Teams.exe'. This indicates an attempt by an unauthorized process to steal Teams authentication tokens.
Detects suspicious shell commands commonly used in various exploit codes, including those associated with Apache Struts vulnerabilities and Metasploit framework activities. The rule looks for patterns indicative of downloading and executing scripts, setting up reverse shells, or modifying file permissions for persistence or privilege escalation.
Detects remote credential dumping activity using Impacket's secretdump tool by monitoring SMB file access patterns. Specifically, it looks for access to the ADMIN$ share with paths containing 'SYSTEM32\' and ending with '.tmp', which is characteristic of secretdump creating temporary files during its operation.
This rule detects attempts to access a Primary Refresh Token (PRT) resource within Azure. A PRT is a key artifact used for single sign-on (SSO) in Azure AD, allowing users to maintain their authenticated state across various applications and services. Unauthorized access to a PRT can enable an adversary to move laterally within an organization's Azure environment, perform credential theft, and bypass multi-factor authentication (MFA) to gain access to resources as the legitimate user. This detection specifically looks for the 'attemptedPrtAccess' risk event type reported by Azure's risk detection service.
This rule detects successful password spray activity. A password spray attack involves an adversary attempting a single or small list of commonly used passwords against many different accounts to acquire valid credentials, often to avoid account lockouts. The detection specifically triggers when Azure AD Identity Protection identifies a 'passwordSpray' risk event.
Detects potential abuse of ntdsutil or similar methods to dump the ntds.dit database. This activity is often associated with credential dumping from Active Directory.
This rule identifies when secrets stored in Azure Key Vaults are modified or deleted. It specifically looks for operations such as writing, deleting, backing up, purging, updating, recovering, restoring, or setting secrets within Azure Key Vaults. This activity can indicate unauthorized access to sensitive credentials or an attempt to disrupt services by removing critical secrets.
This rule detects the usage of cleartext protocols over a network by monitoring firewall logs for allowed connections to specific destination ports commonly associated with unencrypted services. These ports include HTTP (80, 8080), FTP (21), Telnet (23), and various database or application-specific ports (e.g., 1433, 3306, 1521, 27017, 50000, 11211, 15672, 5900-5904). The rule specifically looks for 'forward' or 'accept' actions, or connections not marked as 'blocked', indicating active cleartext communication. The primary goal is to identify potential credential exposure or sensitive data transmission over insecure channels.
This rule detects potential exploitation attempts of CVE-2021-42278, also known as "noPac" or "sAMAccountName spoofing". The exploit involves an attacker creating a computer object with known credentials, then clearing its ServicePrincipalName (SPN) attribute. This manipulation grants the attacker additional permissions on the object, allowing them to make further changes. The detection logic specifically looks for Kerberos Key Distribution Center (KDC) events (EventIDs 35, 36, 37, 38) which indicate anomalies in PAC (Privilege Attribute Certificate) or ticket requests, consistent with the post-exploitation phase of CVE-2021-42278 where forged tickets are used.
This rule detects command-line operations that target common shell history files on Linux systems. Adversaries often manipulate or delete these files to remove traces of their activities or to extract sensitive information like credentials that might have been typed into the command line. The rule specifically looks for execution events (`EXECVE`) that involve files such as `.bash_history`, `.zsh_history`, `.zhistory`, `.history`, `.sh_history`, and `fish_history`.
This rule detects the execution of well-known credential dumping tools by monitoring Windows Security Event ID 4697, which signifies a service creation event. The rule specifically looks for service filenames containing keywords associated with common credential dumping utilities such as 'cachedump', 'dumpsvc', 'fgexec', 'gsecdump', 'mimidrv', 'pwdump', and 'servpw'. This indicates an adversary attempting to install and run a service that can extract credentials from the system.
Detects the execution of a PowerShell script designed to dump stored credentials from Veeam Backup servers. The script specifically targets the "Veeam.Backup" class and uses `Invoke-Sqlcmd` to extract sensitive information, likely from the Veeam configuration database.
Detects when an end user's consent to an application is blocked by Azure AD due to risk-based consent policies. This indicates that Azure AD has identified a risky application or a risky consent request, preventing the user from granting permissions to it. This can be a proactive measure against consent phishing or malicious applications attempting to gain access to user data.
Page 213 of 229