Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,805 detections
Filters
Last updated
All Time
Detection languages
1,678
1,536
487
304
268
Contributors
834
780
764
414
306
Categories
2,347
1,137
625
565
516
Platforms
3,099
696
577
382
322
Products / Services
855
811
566
419
322
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
4,805
CVEs
17
9
8
6
6
IDS Classtypes
89
56
15
14
8
IDS Protocols
101
81
9
7
1
Detects the usage of tooling to sniff network traffic.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Detects commandline operations on shell history files
Detect standard users login that are part of high privileged groups such as the Administrator group
NTLM Brute Force
Sigma
Detects common NTLM brute force device names
Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity
Detects well-known credential dumping tools execution via specific named pipe creation
Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.
Identifies when a key vault is modified or deleted.
Identifies when secrets are modified or deleted in Azure.
End User Consent
Sigma
Detects when an end user consents to an application
Detects when end user consent is blocked due to risk-based consent.
Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD
Indicates access attempt to the PRT resource which can be used to move laterally into an organization or perform credential theft
Detects the creation or patching of potential malicious RoleBinding. This includes RoleBindings and ClusterRoleBinding.
Identifies when the Secrets are Modified or Deleted.
Cisco Collect Data
Sigma
Collect pertinent data from the configuration files
Transferring files with well-known filenames (sensitive files with credential data) using network shares
Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting
Detects tools extracting LSA secret DPAPI domain backup key from Domain Controllers
Detects well-known credential dumping tools execution via service execution events
Detects the registration of the security event source VSSAudit. It would usually trigger when volume shadow copy operations happen.
Page 223 of 229