Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,453
11,838
5,876
5,154
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects web traffic where a user initiates a request for content related to 'policy', 'conduct', 'compliance', or 'handbook', experiences at least three redirects across different hosts, and ultimately lands on a page containing keywords indicative of a login, sign-in, OAuth, or authorization prompt. This pattern is often used in multi-stage phishing campaigns to obscure the malicious infrastructure.
Detects a two-stage credential page that receives an email address and then requests tenant branding or a password form during the same browser session. This behavior is indicative of advanced phishing attacks that attempt to mimic legitimate login flows.
Detects attempts to extract the Active Directory database (NTDS.dit) by monitoring for the execution of administrative tools (vssadmin, diskshadow, ntdsutil, esentutl) with command-line arguments indicative of file copying, shadow copy creation, or database manipulation.
Detects common credential dumping techniques targeting the LSASS process or NTDS.dit database, including the use of known dump utilities such as Procdump, Rundll32 with comsvcs.dll, and Ntdsutil, as well as unauthorized process access to LSASS.
This rule monitors for the usage of the Windows API function 'SetWindowsHookEx' with the hook type 'WH_KEYBOARD_LL' (hook type 13), which is a common technique used by keyloggers and spyware to intercept keystrokes at the system level. The detection triggers when this API call is observed within process execution or API call traces.
Detects the Grixba infostealer (v1.5+) enumerating sensitive browser data (history, cookies, etc.) from multiple common web browsers. The rule monitors for file access events initiated by processes running from non-standard locations such as C:\Users\Public\Music\ or identified by specific .NET binary names associated with Grixba.
Detects suspicious unsigned processes that load user32.dll (often for API hooking) while concurrently writing data to files in temporary or application data directories (consistent with keylogging dump patterns). This rule targets non-system binaries originating from user-writable paths that exhibit combined module loading and file output behaviors typical of keylogger malware like TrymeLocker.
This rule detects the targeted extraction of NPM authentication tokens by monitoring process command lines for the string 'npm_' and correlating it with network connections to a specific IP address (216.126.225.129). This behavior is associated with the Megalodon CI/CD malware.
Detects an AI agent (manipulated by a poisoned recommendation prompt) attempting to access internal Cloud Metadata endpoints (e.g., AWS IMDS, Azure IMDS) to steal underlying infrastructure tokens.
Detects successful device code authentication via the Microsoft Office App (FOCI), which could indicate potential Adversary-in-the-Middle (AiTM) phishing attacks. The rule specifically looks for successful sign-ins using the 'deviceCode' authentication protocol and the AppId associated with Microsoft Office.
Identifies logins from geographically distant locations occurring faster than physically possible, highlighting proxy infrastructure. This KQL query analyzes Google Workspace login success events, grouping them by account and a 10-minute time window. It then filters for instances where an account has successfully logged in from two or more distinct locations within that short timeframe, indicating potential impossible travel.
Detects malicious browser extension behavior where code injection into the MAIN world context is used to access browser session cookies or credential stores. This pattern is characteristic of BadBlocker and similar variants that use remotely-fetched scripts to perform session hijacking.
Detects browser process command line arguments indicating the execution of malicious adblock extensions. The detection identifies these extensions by their known Chrome Extension IDs, observation of requests to specific command-and-control API endpoints, and attempts to execute JavaScript in the MAIN browser world to access sensitive session cookies via document.cookie, cookieStore.getAll, or chrome.cookies.getAll.
Detects the execution of a malicious npm package (scope squatting on @withgoogle/stitch-sdk) that runs a preinstall script designed to harvest sensitive credentials (Claude, Git, SSH, GitHub, npm, Docker) and exfiltrate them to the domain 'stitch-production.org'.
Detects unauthorized access by scripting engines (node.exe, bun.exe, python.exe) to configuration, task files, or sensitive credential stores associated with AI coding assistants and IDEs such as Cursor, Claude, Gemini, and VS Code. This pattern is consistent with the behavior of the Miasma worm, which attempts to exfiltrate developer tokens or environment configurations.
Detects Key Vault access policy or role changes that grant secret-reading capabilities.
Detects theft of Kerberos ccache files containing valid session credentials
Detects deletion of a phishing-resistant authentication method followed by registration of a less secure phone or software token method for the same account.
Detects removal of registered authentication methods shortly after a password reset, a sequence that can prevent the legitimate user from recovering the account. This rule specifically looks for successful 'Delete user authentication method' or 'Remove authentication method' operations in AuditLogs.
Detects a single identity rapidly reading a large number of distinct secrets from an Azure Key Vault within a short timeframe (10 minutes). This behavior is indicative of automated secret harvesting, potentially by an attacker who has compromised an identity with access to the Key Vault. The rule specifically looks for at least 25 reads and 10 distinct secrets accessed by the same identity and IP address within the time window.
Detects Notepad.exe initiating outbound network connections, specifically over SMB (port 445) or to public IP addresses over HTTP/S. This behavior is highly anomalous and can indicate an attempt to exploit a vulnerability (e.g., CVE-2026-20841) to trigger an NTLM relay attack for credential harvesting or to download a remote payload.
Page 121 of 206