Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,437
11,828
5,871
5,150
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
This rule detects the execution of common tools and commands used to perform Kerberoasting, a technique where attackers request Kerberos service tickets for user accounts with Service Principal Names (SPNs) in order to perform offline brute-force attacks to recover plaintext credentials. The rule specifically monitors process creation events for known offensive security tools like Rubeus, as well as specific command-line arguments for 'setspn.exe' and various scripts that can be used to identify potential Kerberoasting targets.
Detects the execution of known Python scripts (CES_Enroll.py, ntlm_ces_relay.py, ces_negotiate_ntlm.py) often associated with NTLM relay attacks or forced authentication techniques. These scripts leverage Python to interact with authentication protocols or relay requests.
Detects potential help-desk impersonation or social engineering activity involving account credential or MFA method resets, followed shortly by a sign-in from an unknown device or geography. The rule excludes activity tied to established ticketing systems or standard automated password expiration processes.
Detects an authentication pattern characteristic of credential compromise, consisting of a burst of failed authentication attempts against an account within a short window, followed immediately by a successful sign-in from an anomalous or new device/location. This pattern is indicative of brute-force or credential spraying followed by successful validation and potential lateral movement.
Detects a multi-stage phishing attack targeting cryptocurrency users, specifically Ledger wallet holders. The detection identifies an initial request to a Vercel-hosted domain for a BIP-39 wordlist (a common recovery phrase standard) followed by a POST request to a similar Vercel-hosted endpoint, suggesting the exfiltration of a secret recovery phrase.
Detects anomalous, bulk file access activity targeting browser credential databases, cryptocurrency wallet data, and application-specific configuration stores, characteristic of the SectopRAT 'DeployBrowserKey' command.
Detects Active Directory replication requests (GetNCChanges) directed at a Domain Controller. This is identified by monitoring Windows Event ID 4662 for specific Directory Service Object GUIDs associated with replication rights. The rule attempts to filter out legitimate traffic from other Domain Controllers by excluding machine accounts ending in the '$' character.
Detects the use of open-source secret-scanning tools (e.g., TruffleHog) by identifying their specific User-Agent strings in AWS CloudTrail logs during GetCallerIdentity calls, followed by suspicious enumeration activity (ListBuckets, ListSecrets, ListAccessKeys) from the same source IP. This behavior is indicative of threat actors validating stolen credentials for unauthorized access to cloud resources.
Detects potential NTLM relay attacks targeting Active Directory Certificate Services (AD CS) web enrollment endpoints, including subsequent certificate requests for sensitive templates. This pattern identifies attackers attempting to relay NTLM authentication to AD CS and potentially requesting certificates for high-privilege templates (e.g., DomainController, SubCA, Machine, or User) to facilitate privilege escalation.
Detects instances where common scripting or development language runtimes (Go, Node.js, WScript, CScript) access sensitive configuration or credential files, such as AWS credentials, Kubernetes configs, SSH keys, or environment files. This activity is often indicative of credential harvesting or unauthorized access to sensitive secrets by potentially malicious scripts or processes.
Detects unauthorized processes attempting to access sensitive browser profile files, such as login credentials, cookies, and session state files. This behavior is indicative of credential harvesting or session theft by malicious software.
Detects autonomous behavior where AI-driven processes attempt multiple network connections (SMB, SSH, HTTP, RDP, WinRM) to diverse targets following failed access attempts. The rule correlates initial failure activity with subsequent credential-related events and new lateral movement traffic from the same agent process within a short window, suggesting adaptive adversary pivoting.
Detects unauthorized processes accessing sensitive credential storage files (e.g., 'Login Data', 'Cookies', 'Local State') from known Chromium-based browser profile directories. This activity is indicative of credential harvesting by infostealer malware attempting to exfiltrate browser data before performing decryption.
Detects a service principal or user account performing a burst of 'ListKeys' operations across multiple Azure Storage accounts. This behavior is indicative of an attacker attempting to dump access keys for multiple storage accounts after initial compromise or privilege escalation to gain further access to sensitive cloud data.
Detects instances where a user account experiences a high volume of failed MFA attempts (MFA push fatigue) within a short window, which is subsequently followed by a successful authentication. This behavior is indicative of an attacker attempting to wear down a user into approving an MFA request for an unauthorized access attempt.
Detects high-volume SSH authentication failures from a single source IP address within a short time frame, which is indicative of credential spraying or brute force activity.
Detects successful Entra ID authentication events where the user login originated from an anonymized or malicious IP address, or exhibited unfamiliar features, despite successfully completing multi-factor authentication (MFA). This pattern is consistent with adversary-in-the-middle (AiTM) phishing attacks, where a proxy service is used to intercept and bypass MFA controls.
Detects a credential-theft pattern associated with Psychedelic Stealer where a process accesses the 'Login Data' file of common Chromium-based browsers, followed shortly by a network connection to a known stealer exfiltration API endpoint.
Detects the CARBONATO GH0ST Hermes Agent activity of harvesting and storing AI API keys (such as OpenAI, Anthropic, Google Gemini, etc.) as plaintext files within the /root/.hermes/loot/ directory. This is consistent with the agent's behavior of staging credentials for later exfiltration.
Detects anomalous, high-volume automated API querying or bulk data exports within SaaS environments that target keywords associated with sensitive information, such as passwords, tokens, or configuration secrets. This pattern is characteristic of automated reconnaissance and unauthorized data harvesting, often observed in campaigns like those attributed to UNC6395.
Detects anomalous use of an OAuth2/OIDC refresh token or Primary Refresh Token (PRT) where the originating device, IP, ASN, or country differs from the initial interactive sign-in within a short timeframe. This behavior is a strong indicator of adversary-in-the-middle (AiTM) attacks, such as Evilginx or Modlishka, where session cookies and tokens are stolen to bypass MFA.
Page 11 of 206