Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,437
11,828
5,871
5,150
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects unauthorized access to common browser credential storage files (Login Data, Cookies, Web Data, Local State) by processes other than standard web browsers. This rule identifies potentially malicious activity by filtering for rare or unsigned binaries executing from common staging directories (Temp, Downloads) or accessing browser files shortly after the process launch, which is a common behavior pattern for info-stealer malware.
Detects potential account compromise by aggregating multiple high-fidelity indicators of adversary activity for a single user within a 72-hour window. The rule triggers when at least three distinct stages of an attack chain are identified, specifically: credential theft/infostealer activity, anomalous sign-in (token reuse/impossible travel), mailbox or OAuth configuration changes, and mass data exfiltration.
Detects Microsoft Windows Event ID 4662 (Object Access) where specific GUIDs associated with sensitive Active Directory rights (specifically, those related to DCSync or sensitive extended rights) are accessed. The rule filters out events originating from Domain Controllers to identify potentially anomalous access patterns from non-DC endpoints.
Detects attempts to create a memory dump of the Local Security Authority Subsystem Service (LSASS) using either the built-in 'comsvcs.dll' library via 'rundll32.exe' or by requesting specific sensitive process access rights to 'lsass.exe' from unauthorized processes.
Detects anomalous Kerberos Ticket Granting Service (TGS) requests from a single user account and IP within a 10-minute window. It specifically flags accounts requesting a high volume of TGS tickets or accessing multiple distinct services, where the tickets use RC4 encryption (0x17), which is a characteristic of Kerberoasting attacks targeting service accounts.
This rule identifies suspicious Kerberos activity indicative of Golden or Silver Ticket attacks. It monitors for service ticket (4769) requests that occur without a preceding TGT request (4768) within a specified window, detects RC4 encryption downgrades on Kerberos requests in environments expected to use AES, and identifies tickets containing non-standard TicketOptions commonly associated with automated forgery tools like Mimikatz.
Detects anomalous Kerberos service ticket (TGS) requests or successful logons where the corresponding Ticket Granting Ticket (TGT) request (Event ID 4768) is absent within the monitored window. This pattern is a primary indicator of offline-forged Kerberos tickets, such as those generated by Mimikatz, which bypass legitimate KDC interaction for ticket issuance.
Detects anomalous lateral movement behavior characterized by an account performing multiple NTLM authentication events (Logon Type 3) across distinct hosts within a short time window, specifically where Kerberos pre-authentication is absent. This pattern is frequently observed in Pass-the-Hash (PtH) attacks where attackers utilize stolen NTLM hashes to move laterally.
Detects a process reading credential store files (Login Data) from multiple Chromium-based browsers, immediately followed by an HTTP POST request to a specific exfiltration endpoint associated with the Psychedelic Stealer malware.
Detects access or modification of files containing sensitive API tokens or keys (such as OpenAI, Anthropic, or Google Gemini) located within the /root/.hermes/loot/ directory. This activity is often associated with the staging of stolen credentials by automated malicious processes.
Detects unauthorized file creation within the /root/.hermes/loot/ directory and specific path combinations associated with the CARBONATO botnet's Hermes Agent. This activity is indicative of credential harvesting, specifically the exfiltration of AI API keys for various LLM providers.
This rule detects potential Kerberoasting activity by monitoring Kerberos TGS requests (Event ID 4769) that use RC4 encryption (0x17 or 17). It identifies accounts requesting TGS tickets for a large number of unique Service Principal Names (SPNs), excluding requests for host-based services (ending in $). High volumes of such requests from a single user are indicative of an attempt to gather service tickets for offline password cracking.
Detects network traffic associated with Adversary-in-the-Middle (AiTM) phishing kits that impersonate Microsoft and Google login pages. The rules identify the presence of specific HTML elements (like Cloudflare Turnstile anti-bot gates) and authentication session cookie headers served from non-authorized/non-official domains, indicating a reverse-proxy phishing attack.
Detects Windows Event 4662 indicating the use of DS-Replication-Get-Changes or DS-Replication-Get-Changes-All extended rights from a host that is not a known domain controller. This behavior is highly indicative of credential dumping via DCSync, commonly associated with tools like Mimikatz.
Detects DCSync attacks by monitoring for EventID 4662 where Active Directory replication extended rights (DS-Replication-Get-Changes and DS-Replication-Get-Changes-All) are requested. This behavior is indicative of unauthorized replication attempts used to extract sensitive data, such as password hashes, directly from a Domain Controller.
Detects Kerberos ticket requests (AS-REQ/TGS-REQ) that exhibit characteristics of a forged Golden Ticket, specifically the use of legacy RC4 (0x17) encryption in environments where AES is typically preferred, non-standard ticket options (0x40810000), and requests for accounts or services that lack a corresponding legitimate authentication event. This detection aims to identify the post-compromise phase where an adversary uses a forged TGT to impersonate domain accounts.
Detects the invocation of Active Directory replication rights by monitoring Event 4662 for specific directory service replication GUIDs (DS-Replication-Get-Changes, DS-Replication-Get-Changes-All). This behavior is characteristic of adversary techniques such as DCSync used by tools like Mimikatz lsadump::dcsync or Impacket secretsdump to extract domain password hashes.
Detects potential DCSync attacks by monitoring for Windows Event ID 4662 (Directory Service Access) associated with specific Directory Replication Service (DRS) extended rights GUIDs. The rule identifies accounts attempting to perform replication tasks against a Domain Controller, filtering out events originating from recognized Domain Controllers to isolate unauthorized access.
This rule detects unauthorized or suspicious processes attempting to access the memory of the Local Security Authority Subsystem Service (LSASS). It specifically targets memory access (EventID 10) with sensitive access masks (e.g., PROCESS_QUERY_LIMITED_INFORMATION, PROCESS_VM_READ) originating from processes executing from suspicious locations such as Temp, AppData, Downloads, or randomly generated executable names. This method is often used by modern credential dumpers, such as those utilizing direct or indirect syscalls, to bypass userland security hooks.
Detects NTLM network logons (LogonType 3 or 9) which often result from a host resolving an attacker-supplied UNC path (e.g., \host
esource) during forced authentication attacks. This rule monitors Windows Security Event ID 4624 to identify incoming NTLM-based network authentication requests, excluding local system logons.
Detects the use of Mimikatz-style command-line arguments to manipulate Kerberos tickets, including ticket requests, purges, and golden/silver ticket creation attempts.
Page 10 of 206