Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,456
11,839
5,876
5,155
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
This rule detects potentially malicious activity related to the npm ecosystem. It identifies Node.js processes accessing .npmrc files (which contain authentication tokens) followed by immediate outbound network communication. Additionally, it detects suspicious command-line patterns associated with automated npm publishing (indicative of worm-like propagation) and the presence of npm credentials in the environment or command lines of non-npm processes.
This rule detects successful network logons (LogonType 3) using NTLM (NTLMv1 or NTLMv2) where the authentication results in an elevated token and the logon originates from a different workstation than the target computer. This combination of factors can indicate lateral movement attempts, especially when an adversary has obtained NTLM hashes (e.g., via Pass-the-Hash or NTLM relay attacks) and is attempting to authenticate to other systems on the network. The rule excludes machine accounts and anonymous logons, as well as loopback authentications, to reduce noise.
Detects suspicious attempts to access macOS Keychain or browser credentials (Chrome, Firefox) using 'osascript' or 'security' command-line utilities. This rule identifies patterns indicative of credential dumping or access, such as unlocking keychains, finding generic passwords, or accessing browser-specific credential files.
Detects when 'explorer.exe' performs clipboard access actions such as opening, getting data from, or setting a clipboard viewer. While 'explorer.exe' is a legitimate Windows process, unusual or excessive clipboard activity from it could indicate suspicious behavior, potentially related to data collection or manipulation.
This rule detects attempts to install a keyboard hook (WH_KEYBOARD_LL) using the SetWindowsHookEx API, specifically when the initiating process is 'explorer.exe'. This behavior can be indicative of keylogging activity, where an attacker attempts to capture keystrokes.
This rule detects when a process other than the legitimate WinSCP application attempts to access WinSCP saved session credentials. This access can occur either by querying the registry key HKCU\Software\Martin Prikryl\WinSCP 2\Sessions or by reading the portable configuration file 'WinSCP.ini'. This activity is suspicious as it indicates an attempt by an unauthorized process to retrieve sensitive connection information, potentially for credential access or lateral movement.
This rule detects suspicious access to macOS Keychain files or the use of the 'security' utility to manipulate keychains. It specifically looks for 'osascript' accessing keychain-related paths, the 'security' utility using commands like 'unlock-keychain' or 'find-generic-password', or common shell utilities ('cp', 'cat', 'sh', 'bash', 'zsh') accessing keychain database files. This activity is often indicative of credential access attempts.
Detects Vidar Stealer scanning the memory of a forked browser process for the Chromium KeyRing 32-byte pattern using NtReadVirtualMemory and NtQueryVirtualMemory to locate the v20_master_key across MEM_COMMIT and MEM_PRIVATE regions.
Detects registration of malicious DLLs as LSASS drivers for credential theft
Detects a web session that proxies an enterprise authorisation endpoint while also handling session-cookie names associated with authenticated access. This rule identifies suspicious activity indicative of an Adversary-in-the-Middle (AiTM) attack where an attacker proxies authentication requests and steals session cookies.
Detects registration of malicious network provider DLLs to capture credentials
This rule detects potential credential capture by monitoring for unauthorized usage of Windows API functions associated with keyboard hooking, such as SetWindowsHookEx and GetAsyncKeyState. It specifically flags suspicious process activity, such as the execution of the 'Pillager' tool or processes interacting with specific suspicious file paths, while excluding common legitimate processes that routinely perform keyboard hooking.
This rule detects common credential dumping techniques targeting the LSASS process memory (using comsvcs.dll, procdump, or procdump64) and extraction of the Active Directory database (NTDS.dit) using ntdsutil, vssadmin, diskshadow, or esentutl. These activities are indicative of credential theft and domain-wide reconnaissance.
Detects techniques used to perform credential dumping from the LSASS process memory, including the use of comsvcs.dll via rundll32, the procdump utility, and unauthorized process handle requests (OpenProcess) targeting lsass.exe.
This rule detects attempts to access macOS Keychain credentials or web browser stored credentials using the 'security' command-line utility. It specifically looks for 'security unlock-keychain' and 'security find-generic-password' commands, with the latter also checking for common browser names like Chrome, Brave, and Microsoft Edge. This activity is indicative of an adversary attempting to dump credentials from the system.
Detects AS-REP Roasting targeting accounts without Kerberos pre-auth
This rule detects the execution of AppleScript (osascript) to display fake System Preferences dialogs and the use of 'dscl . authonly' to validate credentials, which is indicative of the Meow RAT attempting to harvest macOS login passwords. The rule specifically looks for keywords in the command line that suggest a fake dialog (e.g., 'display dialog', 'LockedIcon.icns', 'System Preferences', 'hidden answer', 'default answer') or authentication validation via dscl.
Detects high-privilege access to the LSASS process (lsass.exe), commonly associated with credential dumping techniques such as LSASS memory reading. The rule monitors for specific process access masks (0x1010 and 0x1fffff) originating from non-system, non-security tool processes.
Detects theft of browser session cookies for account takeover
Detects credential harvesting portals from evil twin Wi-Fi access points
Detects the forceful termination of web browsers using taskkill.exe, a common behavior for info stealers attempting to unlock browser databases.
Page 106 of 206