Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,805 detections
Filters
Last updated
All Time
Detection languages
1,678
1,536
487
304
268
Contributors
834
780
764
414
306
Categories
2,347
1,137
625
565
516
Platforms
3,099
696
577
382
322
Products / Services
855
811
566
419
322
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
4,805
CVEs
17
9
8
6
6
IDS Classtypes
89
56
15
14
8
IDS Protocols
101
81
9
7
1
This rule detects when an end user grants consent to an application in Azure Active Directory (now Microsoft Entra ID). Specifically, it triggers when the 'ConsentContext.IsAdminConsent' field is 'false', indicating that the consent was given by a regular user rather than an administrator. This activity can be a precursor to adversaries stealing application access tokens by tricking users into authorizing malicious applications.
This rule detects an anomaly in the SAML token issuer, indicating a potential compromise of the SAML token. The detection is triggered when the 'riskEventType' is 'tokenIssuerAnomaly', suggesting that the claims within the token are unusual or align with known attacker patterns. This could signify an adversary forging web credentials, specifically SAML tokens, to gain unauthorized access.
Detects attempts to extract credentials from files using the 'grep' command to search for the keyword 'password' or by executing the 'laZagne' credential dumping tool. This rule is specifically tailored for macOS environments.
This rule detects the creation of a file named 'dumpert.dmp', which is the default output file used by the Outflank Dumpert tool. Dumpert is a process dumper specifically designed to extract memory from the Local Security Authority Subsystem Service (LSASS) process, which often contains sensitive credential material.
This rule detects the creation of a file named "ntds.dit", which is the Active Directory database. The NTDS.dit file contains critical information including user credentials (hashed passwords), group memberships, and other Active Directory objects. Adversaries often target this file to dump credentials for lateral movement and privilege escalation within a Windows domain.
This rule detects remote access to the Local Security Authority Subsystem Service (LSASS) process via Windows Remote Management (WinRM). This activity is highly indicative of credential dumping attempts, often performed by tools like Mimikatz, to extract sensitive authentication material from memory. The rule specifically looks for process access events where the target process is 'lsass.exe' and the source process initiating the access is 'wsmprovhost.exe', which is associated with WinRM. It also filters out common benign access patterns (0x80000000 GrantedAccess) to reduce false positives.
This rule detects the execution of Mimikatz by identifying specific command-line arguments and keywords commonly associated with its various modules and functions. It looks for terms like 'DumpCreds', 'mimikatz', and module-specific keywords such as '::aadcookie', '::detours', 'sekurlsa::', 'kerberos::', and 'lsadump::'. The rule aims to identify attempts to dump credentials or perform other malicious actions using the Mimikatz tool.
Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords or configuration details that may contain sensitive information. This activity indicates an attempt to dump credentials from IIS.
This rule detects the creation or modification of a specific registry key associated with Windows Credential Editor (WCE). WCE is a tool used to dump credentials from memory, specifically targeting the Local Security Authority Subsystem Service (LSASS). The rule looks for the string 'Services\WCESERVICE\Start' within the 'TargetObject' field of registry events, indicating the installation or activation of WCE as a service.
Identifies user accounts that have been locked due to multiple failed sign-in attempts with incorrect credentials. This often indicates a brute-force attack or password guessing attempt against user accounts.
This rule detects log entries from Juniper BGP services indicating a missing MD5 digest. This condition can be a sign of a brute-force attack attempting to manipulate routing protocols, potentially leading to BGP hijacking or other network disruptions. BGP uses MD5 for authentication to ensure the integrity and authenticity of routing updates between peers. A missing MD5 digest suggests that an unauthenticated or malicious peer is attempting to establish a connection or send updates.
Detects events generated by user-mode applications when they call the CveEventWrite API, indicating that a known vulnerability is potentially being exploited. Microsoft started using this log in January 2020, notably with CVE-2020-0601 (a Windows CryptoAPI vulnerability). However, the rule's description notes that this log has historically seen limited use for reporting CVEs.
This rule detects the installation of packet capture (pcap) drivers on Windows systems by monitoring Event ID 4697 (A service was installed in the system). The detection logic specifically looks for common filenames associated with pcap drivers such as 'pcap', 'npcap', 'npf', 'nm3', 'ndiscap', 'nmnt', 'windivert', 'USBPcap', and 'pktmon' within the ServiceFileName field. The installation of such drivers can indicate an adversary's attempt to perform network sniffing.
This rule detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory with specific uncommon access flags (0x410 and 0x01410). These flags are often used by tools or techniques designed to dump credentials from LSASS, a common method for credential theft on Windows systems. The rule includes extensive filters to reduce false positives from legitimate software that might interact with LSASS.
This detection uses Azure Activity logs (Administrative category) to identify the deletion of an Azure AD Hybrid Health AD FS service instance in a tenant. A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs. The health AD FS service can then be deleted after it is no longer needed via HTTP requests to Azure.
This rule detects anomalous token characteristics, such as an unusual token lifetime or a token being used from an unfamiliar location. This indicates potential compromise or misuse of identity tokens.
Detects BGP failures which may be indicative of brute force attacks to manipulate routing.
This rule detects when an application acquires a certificate private key. This event (EventID 70 in the CAPI2 Operational log) indicates that a private key associated with a certificate has been accessed or exported. This activity can be indicative of an adversary attempting to steal or gain access to authentication certificates for various malicious purposes, such as impersonation or persistence.
This rule detects the creation of files with names commonly associated with credential dumping tools or the output files generated by such tools. This includes executables of known credential dumpers like fgdump, pwdump, cachedump, procdump, and Windows Credential Editor (WCE), as well as output files like 'fgdump-log', 'kirbi', 'pwdump', 'pwhashes', 'wce_ccache', 'wce_krbtkts', 'NTDS.out', 'SAM.out', 'SECURITY.out', and 'SYSTEM.out'.
This rule detects the execution of the legitimate tool 'Mouse Lock' based on its product name, company name, or command line arguments. According to Kaspersky's 2020 Incident Response Analyst Report, this tool has been observed being used by adversaries for credential access and data collection in security incidents, making it a potentially unwanted application (PUA) in a security context.
Detects suspicious process patterns indicative of NTDS.DIT exfiltration attempts. This includes the use of specific tools like NTDSDumpEx, PowerShell scripts (e.g., NTDSgrab.ps1), and command-line utilities (ntdsutil.exe, copy command) to access or copy the ntds.dit file. The rule also looks for these activities originating from suspicious image folders like Apache, Tomcat, AppData, Temp, Public, or PerfLogs.
Page 216 of 229