Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,456
11,839
5,876
5,155
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects access, copying, or creation of files within common cryptocurrency wallet directories, as well as registry lookups related to Bitcoin data directories. This behavior is often indicative of info-stealing malware or an adversary attempting to exfiltrate digital currency assets from a compromised host.
Detects the execution of a local, polymorphic HTML file that contains AI-obfuscated JavaScript, followed by an HTTP POST request to an external server within a 5-minute window, indicating potential credential exfiltration.
Detects read access to the Groups.xml file located in the SYSVOL share. This file is often used by Group Policy Preferences (GPP) to store credentials for local administrator accounts, which can be retrieved and decrypted by unauthorized users.
This rule detects suspicious activities related to OAuth application consent and service principal operations originating from IP addresses identified as proxy infrastructure. Specifically, it looks for actions such as adding service principal credentials, granting OAuth2Permission, consenting to applications, adding delegated permission grants, and adding service principals or applications, when these actions are performed from a proxy IP address. This combination of activities and source IP can indicate an adversary attempting to establish persistence or escalate privileges within an Azure AD environment.
Detects the unique session ID prefix 'xc32038474a' used by the INFINITERED credential harvester. This malware prepends this string to hide stolen plaintext passwords inside the legitimate REDCap sessions database table, which may appear in process command lines during execution or data handling.
Detects the unique session ID prefix 'xc32038474a' used by the INFINITERED credential harvester. The malware prepends this string to hide stolen plaintext passwords inside the legitimate REDCap sessions database table, which may appear in process command lines when interacting with the database.
Detects unauthorized processes reading, copying, or renaming Kerberos ticket cache files (ccache) located in common temporary directories. This behavior is often associated with credential theft and potential Pass the Ticket attacks where adversaries attempt to extract session credentials to perform lateral movement or privilege escalation.
AD Explorer Creates a Directory Snapshot
Cortex XDR
Detects AD Explorer running with the snapshot option and writing result.dat into a temporary directory. This activity is often associated with reconnaissance and credential dumping in Active Directory environments.
Detects attempts by processes identified as Remcos RAT or its loader (GST*.com) to access Local Security Authority (LSA) secrets. This activity is indicative of credential dumping, where an attacker tries to extract sensitive authentication material from the system.
Detects attempts by processes identified as Remcos RAT or its loader (GST*.com) to access Local Security Authority (LSA) secrets. This activity is indicative of credential dumping, where an attacker tries to extract sensitive authentication material from the system.
Detects a successful self-service password reset for a privileged or high-value account when the initiating context does not match an approved helpdesk workflow.
Detects rapid failed local Windows account logon attempts consistent with Pony malware's built-in dictionary brute-force routine. The rule identifies a high volume of type-2 interactive logon failures against multiple local accounts in a short time window, indicative of brute-force activity using LogonUserA.
Detects Vidar Stealer using NtQueueApcThreadEx2 with QUEUE_USER_APC_FLAGS_SPECIAL_USER_APC to immediately execute CryptUnprotectMemory in a live browser thread for ABE v20_master_key extraction, preceded by thread enumeration via CreateToolhelp32Snapshot, Thread32First/Next, and NtOpenThread.
Detects successful non-interactive token acquisitions using specific Microsoft first-party application IDs known to bypass Entra Conditional Access Policies through Nested App Authentication (NAA/BroCI). The detection specifically targets sign-ins to the Microsoft Graph resource.
This rule detects instances where 'python.exe' aggressively accesses files within '.ssh' directories. This behavior could indicate an attempt to harvest SSH keys, which are critical for secure remote access.
Detects a RedVDS login followed by commands modifying domain trusts or attempting Active Directory Certificate Services (AD CS) abuse within a 2-hour window. The rule specifically looks for 'Certify.exe' or 'nltest /domain_trusts' commands after a login from a predefined RedVDS IP range.
Detects a payload aggressively accessing browser credential stores (Login Data, Cookies, Web Data) in a rapid sequence, specifically when initiated by processes matching common VPN client names like GlobalProtect or AnyConnect. This behavior is indicative of infostealer activity, attempting to exfiltrate sensitive browser data.
Detects unauthorized processes attempting to access sensitive browser files such as 'Login Data', 'Cookies', and 'Web Data' files typically located in Chrome or Firefox user profiles. This behavior is indicative of credential theft or data exfiltration, as these files contain saved usernames, passwords, and session cookies.
Detects instances of wermgr.exe (Windows Error Reporting) interacting with Volume Shadow Copies or using specific Alternate Data Streams (WDFOO). This behavior is often associated with credential dumping tools (e.g., Mimikatz, SharpShadow) attempting to access sensitive files from shadow copies under the context of a non-system user, potentially indicating evasion techniques or credential harvesting.
This rule detects when processes other than legitimate browser-related binaries access Google Chrome's 'Login Data' or 'Local State' files. These files contain sensitive browser data, including stored credentials, and unauthorized access is a common indicator of credential theft or dumping attempts by malicious software.
Detects a Google account completing an OAuth or MFA challenge and then generating a new session from a different client fingerprint (different source IP or user agent) within a 10-minute window. This behavior can indicate a session hijack or an adversary bypassing MFA.
Page 108 of 206