Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,309 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,445
11,833
5,875
5,151
4,864
4,309
Platforms
2,571
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,348
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects authentication events originating from Microsoft Authentication Broker or OfficeHome using Node.js associated user agents, which are indicative of the Tycoon 2FA kit relay infrastructure. This activity suggests an Adversary-in-the-Middle (AiTM) attack attempting to bypass multi-factor authentication.
Detects suspicious file read or access events targeting cryptocurrency wallet files (e.g., wallet.dat, keystore, .metamask, Exodus wallet) and browser extension data stores (e.g., Chrome Local Extension Settings, MetaMask, BraveSoftware). The rule specifically excludes common browser processes to reduce false positives, indicating an attempt by an unauthorized process to enumerate or scrape sensitive cryptocurrency-related data.
Detects a spike in successful operations related to Azure Storage Account Keys by a single caller within a one-hour window. This could indicate an adversary attempting to enumerate, access, or exfiltrate storage account keys, or a legitimate user performing multiple key management activities.
Detects suspicious device access patterns and multiple failed authentication attempts from unmanaged devices and outside the corporate network, combined with Azure AD Identity Protection risk states. This rule identifies potential credential access attempts or account compromise.
Detects access to AWS credentials files for cloud account credential theft
Detects retrieval of secrets from AWS Secrets Manager
Detects multiple instances of a non-SYSTEM or non-LOCAL SERVICE account using 'RunAs' to execute processes as highly privileged accounts (admin, system, root) within a short timeframe. This could indicate an attempt at privilege escalation or token impersonation.
This rule detects attempts to access or dump the Local Security Authority Subsystem Service (LSASS) process memory or the NTDS.dit file, which can contain sensitive credential information. It specifically looks for Security Event ID 4656 (handle to an object was requested) where the target object is 'lsass.exe', 'lsass.bin', or 'ntds.dit', with specific access masks ('0x1fffff' or '0x1410'), and excludes common system accounts. A high count of such access attempts within an hour from a non-system user triggers the alert.
This correlation rule detects a high number of failed login attempts for a single user account on a specific endpoint, which may indicate a brute-force attack. For this rule to be effective, it is recommended to set the 'Correlation Entity' to 'User' to group alerts by the targeted user.
Detects searching of bash history files for credentials
Detects Pass-the-Hash attacks using NTLM authentication over SMB
Identifies outbound network connections to the Microsoft Device Code authentication endpoint, which may indicate phishing attempts (e.g., via PhaaS kits like Kali365).
Maps the malicious cache wrapper accessing local Steam configuration files for token harvesting.
Detects the exploited Bomgar process explicitly attempting to read sensitive credential files (like the SAM registry hive dump or /etc/shadow) to escalate privileges.
Identifies the payload invoking the native macOS security command-line utility to dump passwords and certificates from the user's Keychain, specifically when the initiating process is located in the /tmp/ directory, which is often used by malware for temporary execution.
This rule detects the dynamic compilation of C# code using csc.exe followed by immediate access to DPAPI (Data Protection API) vault files. This sequence of events can indicate an adversary compiling and executing code on the fly to decrypt or access sensitive credentials protected by DPAPI.
Identifies suspicious access to Steam configuration files (loginusers.vdf) by processes other than legitimate Steam applications, combined with network connections to known malicious URLs associated with token theft. This rule aims to detect injected or hidden wrappers attempting to steal Steam tokens.
Identifies network traffic requesting 'te_3_la.js', a script used by UnregStealer to strip password masking from DOM elements, facilitating credential theft.
This rule detects a malicious npm package attempting to read Claude MCP connection settings, which may contain sensitive information like API keys and server details. The theft of MCP configuration could allow attackers to impersonate AI integrations. If this rule triggers, the package should be removed, and any associated API keys should be rotated. Further investigation should involve questioning the user about recent software installations or clicked links, and engaging the security team if the situation remains unclear.
Monitors for device code authentication via uncommon Family of Client IDs (FOCI) applications. This rule identifies successful device code authentications where the application ID (AppId) has been observed fewer than 5 times, indicating potentially rare or newly introduced applications. This could be indicative of an adversary attempting to use a malicious application for device code phishing.
Detects unauthorized access to macOS Keychain for credential extraction
Page 127 of 206