Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,309 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,445
11,833
5,875
5,151
4,864
4,309
Platforms
2,571
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,348
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
This rule detects repeated access attempts (read or write) to files or directories commonly associated with software build artifacts (e.g., 'build', 'release', 'artifact', 'bin', 'dist'). It specifically looks for Security Event ID 4656, which indicates a handle to an object was requested, and filters out common system accounts to focus on user-initiated access. A high number of access attempts (5 or more) within an hour by a non-system user to these sensitive object names could indicate an attempt to compromise or exfiltrate software supply chain components.
This rule detects suspicious command-line activity related to Duo Security administration. It looks for processes executing with 'duo_client', 'duo_admin', or 'duo_api' in their command line, combined with sensitive parameters like '--admin-api', '--key', '--secret', or 'token'. The rule specifically excludes processes spawned by 'powershell.exe' or 'cmd.exe' to reduce noise, and triggers if such activity occurs at least twice within an hour on the same computer by the same user. This could indicate an attempt to manipulate Duo Security configurations, potentially to bypass multi-factor authentication.
This rule detects potential credential harvesting attempts by identifying a high volume of short-duration HTTP requests to common login, sign-in, verify, account, or authentication URI stems. It specifically looks for requests originating from user agents commonly associated with bots or scripting tools (e.g., 'bot', 'curl', 'python', 'powershell') and successful HTTP status codes (200). The 'short' session duration is inferred from small response sizes (less than 5000 bytes), suggesting automated access rather than human interaction.
Detects the execution of known credential extraction tools such as Mimikatz, LaZagne, Hashcat, or John the Ripper, indicated by specific keywords in the command line arguments. This rule monitors for process creation events (EventID 4688) where these tools are used in conjunction with keywords related to passwords, hashes, or credentials.
This rule detects attempts to extract authorization headers (Bearer, Basic, or X-API-Key) over FTP (port 21) by inspecting network signatures. This could indicate an attempt to exploit a vulnerability or misconfiguration where sensitive credentials are being transmitted in an insecure manner.
This rule detects suspicious sign-in attempts to Azure AD where Conditional Access policies were not applied, the sign-in was successful, and the user agent string indicates a bot, crawler, headless browser, or common scripting tools like curl, wget, or python. It specifically looks for multiple such logins or logins from multiple unique devices within a 5-minute window for the same user and risk detail.
This rule detects the execution of processes with command-line arguments indicative of credential theft tools such as Mimikatz, lsadump, sekurlsa, vault, cachedump, or hashdump. It specifically looks for these keywords within Security Event ID 4688 (a process creation event) logs.
Detects unauthorized processes reading the .bash_history file concurrently with AWS CLI activity, which could indicate an adversary attempting to extract credentials or sensitive information from command history while interacting with AWS services. This behavior is associated with the Megalodon CI/CD malware.
This rule detects when the ScreenConnect process accesses DPAPI-related files, specifically those within the 'Protect\S-1-5-21-' folder. This activity is indicative of credential theft, as observed in the 'Operation SilentCanvas' campaign where a trojanized ScreenConnect was used for this purpose.
This rule detects the attempted extraction of Slack API tokens (specifically 'xoxb-' prefixed tokens) from process command lines, combined with network activity to a specific IP address (216.126.225.129). This combination suggests an attempt to harvest and exfiltrate Slack tokens, potentially by the Megalodon CI/CD malware.
This rule detects attempts by a malicious cache wrapper (specifically, a process named `._cache_GAME1.exe`) to access local Steam configuration files, which could indicate token harvesting. The rule looks for file access events on paths containing `\config\loginusers.vdf` initiated by the specified malicious process.
This rule looks for exposed pairs of credentials used for GitHub cloud identity federation in logs or artifacts. Leaked pairs let attackers mint tokens as your pipeline. Rotate federation settings and audit recent workflow runs.
Detects PHP or web server processes launching command-line database clients. INFINITERED collected database credentials and supported arbitrary SQL execution against compromised REDCap environments. Direct database-client execution by a web-serving process is uncommon and may indicate credential access, data collection, or backdoor command execution.
Detects reading of AutoLogon credentials stored in Winlogon registry key
Detects login attempts using default admin credentials on web interfaces
Detects creation of additional IAM access keys for cloud account persistence
Detects use of forged web cookies for bypassing authentication
Detects fake Windows authentication prompts used to capture credentials
This rule detects anomalous access to cloud services, specifically Salesforce, Drift, Salesloft, HubSpot, and Marketo, that may indicate OAuth token abuse. It identifies scenarios where a high volume of actions (8 or more) occur within a short timeframe (3 hours or less) from a single IP address but with multiple unique user agents (2 or more). The detection is further refined by looking for actions related to 'Add delegated permission grant' or 'Create service principal', which are indicative of an attacker attempting to establish persistence or escalate privileges after gaining access through a compromised OAuth token.
Detects exploitation of Kerberos protocol for credential theft
Detects access to Chrome Login Data SQLite file for credential theft
Page 130 of 206