Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,805 detections
Filters
Last updated
All Time
Detection languages
1,678
1,536
487
304
268
Contributors
834
780
764
414
306
Categories
2,347
1,137
625
565
516
Platforms
3,099
696
577
382
322
Products / Services
855
811
566
419
322
MITRE Techniques
18,115
15,635
12,577
8,388
6,220
4,805
CVEs
17
9
8
6
6
IDS Classtypes
89
56
15
14
8
IDS Protocols
101
81
9
7
1
Detects suspicious session with two users present
Detects events with patterns found in commands used for reconnaissance on linux systems
Detects passwords dumps from Keychain
Credentials In Files
Sigma
Detecting attempts to extract passwords with grep and laZagne
Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels.
Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access.
Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access.
Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml
Ntdsutil Abuse
Sigma
Detects potential abuse of ntdsutil to dump ntds.dit database
Detects when an application acquires a certificate private key
Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store.
Detects certificate creation with template allowing risk permission subject
Detects certificate creation with template allowing risk permission subject and risky EKU
Detect AD credential dumping using impacket secretdump HKTL
Detect PetitPotam coerced authentication activity.
Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to the client
Detects failed Kerberos TGT issue operation. This can be a sign of manipulations of TGT messages by an attacker.
Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN
Detects service ticket requests using RC4 encryption type
Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.
Detects the registration of the security event source VSSAudit. It would usually trigger when volume shadow copy operations happen.
Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name located in the temp directory have been reset.
This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default).
Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.
This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default).
Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.
Detects volume shadow copy mount via Windows event log
Page 225 of 229