Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,456
11,839
5,876
5,155
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects unauthorized access, modification, or deletion attempts against common web browser credential storage files (key4.db, logins.json, and Microsoft Edge 'Login Data'). These files store sensitive authentication information, and non-browser processes interacting with them are indicative of credential harvesting attempts.
Detects MFA factor activation, device enrollment, and password resets originating from residential/commercial proxy infrastructure, often associated with threat groups like BlackFile/UNC6671/Cordial Spider.
Detects unauthorized access, modification, or deletion attempts against common web browser credential storage files (key4.db, logins.json, and Microsoft Edge 'Login Data'). These files store sensitive authentication information, and non-browser processes interacting with them are indicative of credential harvesting attempts.
This rule detects unauthorized access, creation, or modification of browser-specific sensitive credential files (such as 'Login Data' or 'cookies.sqlite') by processes that are not recognized web browsers or trusted update services. This behavior is a common indicator of information-stealer malware attempting to harvest session cookies and stored credentials.
Detects the execution of specific Python scripts associated with the FortiBleed campaign. These scripts include 'spray_da.py' for domain admin password spraying, 'smb_test.py' for SMB validation and lateral movement, 'spider.py' for Active Directory crawling, and 'ad_full_audit.py' for Active Directory auditing. Detection is based on the Python interpreter executing these specific script filenames.
This rule detects network traffic indicative of the 'EvilTokens' phishing kit, specifically targeting Microsoft OAuth Device Code flow. It looks for HTTP POST requests to the '/api/device/start' URI on domains hosted on Cloudflare Workers ('.workers.dev'). This pattern suggests an attempt to initiate a device code phishing attack, where adversaries trick users into entering credentials or codes to grant access to malicious applications.
Detects rapid failed local Windows account logon attempts consistent with Pony malware's built-in dictionary brute-force routine, which enumerates local accounts via NetUserEnum and cycles passwords via LogonUserA (advapi32). A high volume of type-2 interactive logon failures against multiple local accounts in a short window is the key behavioral signal.
Detects unauthorized or suspicious processes attempting to access the memory of the Local Security Authority Subsystem Service (lsass.exe). This activity often indicates attempts to dump process memory to harvest sensitive credentials, a common technique used by attackers to facilitate lateral movement.
Detects a browser session that contacts an EvilTokens Device Code phishing endpoint (/api/device/status/) and then immediately navigates to onedrive.live.com, indicating the attacker backend returned status:completed and the kit executed window.location.replace to redirect the victim to OneDrive after token capture. This sequence suggests a successful device code phishing attack where the victim's credentials or tokens have been captured, and they are then redirected to a legitimate service to avoid suspicion.
Detects a browser session that contacts an EvilTokens Device Code phishing endpoint (/api/device/status/) and then immediately navigates to onedrive.live.com, indicating the attacker backend returned status:completed and the kit executed window.location.replace to redirect the victim to OneDrive after token capture. This sequence suggests a successful device code phishing attack where the victim's credentials or tokens have been captured, and they are then redirected to a legitimate service to avoid suspicion.
Detects cross-process memory access attempts targeting the Local Security Authority Subsystem Service (lsass.exe). The rule filters out known Microsoft-signed system processes and common Windows binaries to identify potential unauthorized credential dumping activity.
This rule detects successful user sign-ins from anomalous IP addresses, indicative of an Adversary-in-the-Middle (AiTM) reverse proxy attack. It correlates successful logins with the receipt of a phishing email containing specific subject keywords ('Code of Conduct') within a two-hour window, suggesting that the login was a direct result of the phishing lure.
Detects the execution of 'osascript' with command-line arguments indicative of a credential phishing attempt, specifically looking for prompts that display a dialog asking for a password with a hidden answer field. This is associated with the Sapphire Sleet threat actor's macOS intrusion techniques.
Detects attempts to extract the Security Account Manager (SAM) database, either by using the 'reg save' utility to export registry hives containing the SAM or by directly creating/modifying the SAM file on disk outside of known legitimate system processes.
This rule detects the execution of the Rubeus tool or the usage of common command-line arguments associated with Kerberoasting activities (e.g., GetUserSPNs, Request-SPNTicket). Kerberoasting is a technique used to extract service account password hashes from Active Directory by requesting service tickets for accounts with Service Principal Names (SPNs). These hashes can then be cracked offline to obtain cleartext credentials.
Detects a compromised account revoking refresh tokens, signing out other sessions, or replacing authentication state to retain exclusive access. This behavior is indicative of an attacker attempting to maintain exclusive control over a compromised account by invalidating other legitimate sessions or tokens.
This rule detects potential credential dumping attempts against the Local Security Authority Subsystem Service (LSASS). It monitors two distinct suspicious behaviors: 1) The enablement of 'SeDebugPrivilege' by non-system processes via Windows security event 4703, and 2) Suspicious OpenProcess calls targeting sensitive Windows processes (lsass.exe, csrss.exe, winlogon.exe, services.exe, smss.exe) initiated by non-system accounts with high-level access rights.
Detects instances where processes other than legitimate browser components attempt to access, read, or copy the browser 'Login Data' file. This file stores credentials used by Google Chrome and Microsoft Edge, and unauthorized access is a common technique used by credential-stealing malware.
This rule detects potential credential dumping attempts against the Local Security Authority Subsystem Service (LSASS). It monitors two distinct suspicious behaviors: 1) The enablement of 'SeDebugPrivilege' by non-system processes via Windows security event 4703, and 2) Suspicious OpenProcess calls targeting sensitive Windows processes (lsass.exe, csrss.exe, winlogon.exe, services.exe, smss.exe) initiated by non-system accounts with high-level access rights.
Detects instances where processes other than legitimate browser components attempt to access, read, or copy the browser 'Login Data' file. This file stores credentials used by Google Chrome and Microsoft Edge, and unauthorized access is a common technique used by credential-stealing malware.
Detects attempts to exploit the Windows Search URI handler vulnerability (CVE-2023-29357) which can lead to NTLM credential leaks. This rule specifically looks for process command lines that invoke the 'search' or 'search-ms' URI scheme with a 'crumb=location:' parameter pointing to an UNC path, indicating an attempt to coerce NTLM authentication.
Page 103 of 206