Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,456
11,839
5,876
5,155
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects Node.js attempting to query the AWS/GCP internal metadata IP (169.254.169.254) to extract cloud instance IAM roles. This activity is associated with the Stitch-SDK scope squatting credential harvester.
Detects Device Code Flow authentication originating from abused Railway.com infrastructure, widely abused by Kali365.
Detects access to Group Policy Preferences files with encrypted passwords
Detects successful non-interactive token acquisitions using specific Microsoft first-party application IDs known to bypass Entra Conditional Access Policies through Nested App Authentication (NAA/BroCI). The detection specifically targets sign-ins to the Microsoft Graph resource.
This rule detects suspicious activities related to OAuth application consent and service principal operations originating from proxy infrastructure. Specifically, it looks for actions such as adding service principal credentials, granting OAuth2Permission, consenting to applications, adding delegated permission grants, or adding new service principals/applications, where the initiating IP address is identified as belonging to a proxy service. This combination of activities and source IP can indicate an adversary attempting to establish persistence or escalate privileges within an Azure AD environment.
This rule detects the creation, modification, or renaming of the `authorized_keys` file within the `.ssh` directory by processes other than common SSH key management or shell utilities. This activity could indicate an adversary attempting to establish persistence or elevate privileges by adding their own public key for SSH access.
Detects the unique session ID prefix 'xc32038474a' used by the INFINITERED credential harvester. The malware prepends this string to hide stolen plaintext passwords inside the legitimate REDCap sessions database table, which may appear in process command lines when interacting with the database.
Detects a browser session that contacts an EvilTokens Device Code phishing endpoint (/api/device/status/) and then immediately navigates to onedrive.live.com, indicating the attacker backend returned status:completed and the kit executed window.location.replace to redirect the victim to OneDrive after token capture. This sequence suggests a successful device code phishing attack where the victim's credentials or tokens have been captured, and they are then redirected to a legitimate service to avoid suspicion.
Detects suspicious process executions where 'ctfmon.exe' or 'cloudfiles.exe' are initiated by a non-SYSTEM user but contain 'SYSTEM' in their command line. This could indicate an attempt to impersonate or escalate privileges.
This rule monitors for a sequential attack chain occurring within a 15-minute window. It links a high-risk or risky user sign-in to subsequent reconnaissance (whoami, ipconfig), credential access (LSASS dumping, registry hive export), and lateral movement (network connections over port 445).
This rule monitors for a sequential attack chain occurring within a 15-minute window. It links a high-risk or risky user sign-in to subsequent reconnaissance (whoami, ipconfig), credential access (LSASS dumping, registry hive export), and lateral movement (network connections over port 445).
Detects attempts to read the 'Groups.xml' file within the SYSVOL share. This file can contain sensitive credential information if Group Policy Preferences were used to deploy local user accounts or services, as the passwords might be stored in a decryptable format. Adversaries often target this file to extract credentials.
Detects suspicious process executions where 'ctfmon.exe' or 'cloudfiles.exe' are initiated by a non-SYSTEM user but contain 'SYSTEM' in their command line. This could indicate an attempt to impersonate or escalate privileges, potentially by manipulating process arguments to mimic system processes.
This rule detects attempts by non-browser executables to access DPAPI (Data Protection API) for decryption, specifically when the command line also references Chromium Local State. This behavior is indicative of credential theft, where an attacker might be trying to extract stored browser credentials. The rule filters out legitimate browser processes (Chrome, MS Edge, Brave) to reduce false positives and focuses on the causal chain of events.
Identifies a single IP address (the attacker) accessing multiple distinct enterprise applications (Exchange, SharePoint, Teams) in rapid succession using a hijacked cookie.
Correlates a successful AAD sign-in from a new IP address immediately followed by the registration of a new FIDO2 or Authenticator device, a hallmark of AiTM persistence.
Identifies high-volume password spray attacks against Microsoft 365 originating from RedVDS infrastructure by counting unique targeted accounts from a single IP. The rule specifically looks for invalid credential errors (50126, 50053) and triggers if more than 50 unique failed accounts are observed from a single IP address within a 15-minute window.
Correlates the execution of a script from a cloned repository accessing developer credential stores (SSH keys, AWS profiles) within a tight time window. This rule specifically looks for file access events on common credential files (id_rsa, credentials, config) within sensitive directories (.ssh, .aws, .kube) that are initiated by a process whose command line contains keywords often associated with development activities or social engineering lures (interview, test, assignment).
Detects scripts (Python/Node/VBS) directly accessing Chrome or OS-level DPAPI structures (Login Data, Cookies) to extract user credentials.
Detects unauthorized processes aggressively reading Chromium and Safari browser database files (Login Data, Cookies, Web Data) on macOS, which is indicative of credential stealing attempts. The rule specifically looks for file access events to browser profile directories where these sensitive files are stored, excluding legitimate browser processes.
This rule correlates the credential scraping phase with the invocation of zip, tar, or ditto to compress stolen artifacts into a single file in the /tmp directory. Specifically, it looks for these archiving utilities being executed with a command line that targets a .zip or .tar.gz file within /tmp, and joins this activity with the prior access of a file named 'Login Data' by the same initiating process.
Page 120 of 206