Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,456
11,839
5,876
5,155
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects file creation or modification events within the Windows Credential Vault folder (AppData\Local\Microsoft\Vault), excluding legitimate activity by the 'vaultsvc.exe' process. This could indicate an attempt to access, modify, or exfiltrate stored credentials.
Detects processes containing sensitive credential-related keywords (cookies, creds, password, token) in their command lines followed by a network connection to known suspicious remote IP addresses within a 60-minute window, suggesting potential credential exfiltration.
This rule detects non-browser processes attempting to access sensitive local files associated with common web browsers (Google Chrome, Microsoft Edge, and Mozilla Firefox). Specifically, it monitors for file events involving login databases, cookies, and key storage files by processes other than legitimate browser executables, which is a common technique used by credential-stealing malware.
Detects adversary activity consistent with credential dumping tools like KuinaExtractor. The rule monitors for the enumeration of Windows Credential Manager stores using vaultcmd /list or cmdkey /list, and the direct instantiation of the Windows PasswordVault via PowerShell, excluding system accounts and known legitimate applications.
This rule detects processes other than standard browsers (Chrome, Edge, Firefox, Opera) or authorized password managers (KeePass) accessing sensitive files such as browser credential stores, cookies, local state configuration files, KeePass databases (.kdbx), or VPN configuration files (.ovpn). The rule identifies suspicious activity by monitoring for access patterns that indicate potential credential theft or exfiltration.
Detects adversary activity consistent with credential dumping tools like KuinaExtractor. The rule monitors for the enumeration of Windows Credential Manager stores using vaultcmd /list or cmdkey /list, and the direct instantiation of the Windows PasswordVault via PowerShell, excluding system accounts and known legitimate applications.
Detects the malicious execution of the Bun JavaScript runtime associated with the Miasma supply chain attack. The rule identifies suspicious child processes spawned from development directories (like node_modules) that execute Bun to read sensitive configuration files, SSH keys, and cloud credentials typically targeted for exfiltration.
Detects reconnaissance and credential harvesting activities associated with the Lambsys cryptominer campaign. The rule monitors for unauthorized enumeration of SSH directories, key files, and the use of SSH utilities for lateral movement, specifically triggered by the presence of 'isp.sh' or 'lambsys' in command arguments or related patterns.
Identifies the compromised session token being reused rapidly across Exchange Online, SharePoint, and Teams from a single IP to harvest data. This rule detects when a single account object ID and IP address access 3 or more distinct applications within a 5-minute window, which could indicate the reuse of a compromised token.
Detects unauthorized cross-process memory access attempts targeting the Local Security Authority Subsystem Service (lsass.exe). Such attempts are commonly associated with credential dumping techniques to extract credentials from memory.
Detects SYSTEM privilege escalation attempts via ctfmon.exe or cloudfiles.exe processes.
Detects instances where non-browser processes (that are not signed by major browser vendors) attempt to access common browser credential files such as 'Login Data' or 'logins.json'. This behavior is characteristic of credential dumping or exfiltration attempts by malicious software trying to steal stored browser passwords.
Detects low-and-slow password spraying activity against Entra ID by identifying a single source IP generating authentication failures (AADSTS50126) across multiple distinct accounts within a short window. This technique is used to obtain valid credentials for subsequent Microsoft Graph token abuse via hidden Conditional Access policy exclusions (CVE-2025-0309).
This rule detects suspicious processes (e.g., cmd.exe, powershell.exe, curl.exe) or the execution of vaultcmd.exe accessing browser credential files (Login Data, Web Data, logins.json, key4.db) or utilizing DPAPI (CryptUnprotectData) to extract stored credentials. This behavior is indicative of credential harvesting often observed in infostealer campaigns.
Detects modifications to the 'Authentication Packages' registry key that include a '.dll' file. Adversaries may abuse authentication packages to execute DLLs when the system boots, establishing persistence and potentially escalating privileges.
The rule detects potential credential dumping activities by monitoring for the execution of Mimikatz or the use of its specific command-line arguments (e.g., sekurlsa::logonpasswords, /ntlm:). It also monitors for suspicious, unauthorized processes attempting to open a handle to the LSASS process to access its memory, a common technique for dumping credentials.
This rule detects network connections to port 389 (LDAP) that contain specific keywords related to Active Directory trust relationships. This could indicate an adversary attempting to discover trust details within an Active Directory environment.
Monitors for the use of 'sshpass' to automate SSH logins using specific accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm) with disabled strict host key checking. This technique was observed in ShinyHunters attacks.
Identifies the Python script explicitly reading developer secrets including AWS credentials, SSH private keys, and Kubernetes configuration files.
Detects potentially malicious process execution behaviors, including the use of 'runas.exe' with saved credentials, the execution of 'runas.exe' by unauthorized users, and unauthorized cross-process access to sensitive Windows system processes such as lsass.exe, winlogon.exe, or services.exe, which are common indicators of credential access or privilege escalation attempts.
This rule detects activities associated with credential dumping, specifically targeting techniques that abuse the Directory Replication Service (DRS) protocol, such as DCSync or the use of tools like secretsdump. It monitors both process execution command lines and network traffic for keywords indicative of these credential extraction behaviors, which are commonly used by attackers to obtain domain credentials.
Page 102 of 206