Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
This rule detects multiple unauthorized access attempts (5 or more within an hour) to sensitive Active Directory objects such as 'Admin', 'krbtgt', or 'Domain Admins'. It leverages Windows Security Event ID 4662, which indicates an operation was performed on an object, and filters for specific sensitive object names. The rule then groups these attempts by object, IP address, and user, alerting when a threshold of attempts is met.
Detects attempts to abuse the device code flow targeting Microsoft Office and Authentication Broker applications from unmanaged and non-compliant devices with unbound tokens. This activity is indicative of device code phishing, where an attacker tricks a user into authenticating a malicious application.
Detects abuse of the microsoft.Web/sites/publishxml/action operation to retrieve application publishing profiles and basic auth credentials.
Detects high-volume email campaigns that exhibit characteristics of sophisticated phishing, including spoofed sender domains, urgent subject lines, and multiple URLs in the email body, indicative of credential harvesting attempts. The rule specifically looks for emails delivered to 'Deleted' or 'Junk' folders, from non-company domains that resemble company domains, and containing keywords often used in phishing lures.
Detects reading of process memory via /proc filesystem for credential extraction
Detects Kerberoasting via service ticket enumeration tools
Detects Silver Ticket attack using forged Kerberos service tickets
Detects use of forged web credentials for unauthorized application access
This rule detects potential Kerberos Golden Ticket attacks by identifying Kerberos authentication service (AS) request events (EventID 4768) where the ticket encryption type is 0x17 (RC4-HMAC) and the difference between the event generation time and the ticket's start time is greater than one day. This large time difference can indicate a forged ticket with an invalid timestamp, a common characteristic of Golden Tickets. The rule then summarizes these events by target username and computer, flagging instances where three or more such events occur.
This rule detects the delivery of a payload associated with the 'Incognito Token Theft Tool'. It specifically looks for the case-insensitive string 'list_tokens' within HTTP response body content flowing from a server to a client. This string is indicative of the tool's functionality, which often involves listing tokens for exfiltration or further abuse, suggesting an attempt at privilege escalation or credential access.
Detects installation of password filter DLLs to intercept plaintext passwords
Detects access to Chrome Login Data SQLite file for credential theft
Detects phishing links with credential harvesting redirects
Detects access to .env files that may contain plaintext credentials
Detects phishing links with credential harvesting redirects
Detects exploitation of Kerberos protocol for credential theft
This rule detects multiple (3 or more) logon attempts using the 'RunAs' feature (Event ID 4648) for accounts containing 'Admin' or 'SYSTEM' in their username within a one-hour window. This could indicate an adversary attempting to escalate privileges or execute code as a privileged user.
This rule detects NBT-NS (NetBIOS Name Service) poisoning responses. NBT-NS poisoning is a technique used by attackers to intercept network traffic by responding to NetBIOS name queries with their own IP address, effectively redirecting traffic. The rule specifically looks for UDP traffic on port 137 (NetBIOS Name Service) destined for the home network, containing the byte sequence '|85 00|' at a depth of 4 bytes, which is indicative of a NetBIOS Name Service response. A threshold of 5 such responses within 10 seconds from the same source IP triggers the alert, aiming to reduce false positives from legitimate, but infrequent, NBT-NS responses.
Detects enabling of reversible password encryption in Active Directory
This rule detects when a process other than Firefox itself attempts to access critical Firefox profile artifacts such as key4.db, cert9.db, logins.json, cookies.sqlite, places.sqlite, formhistory.sqlite, and prefs.js. This activity is highly suspicious as these files contain sensitive user data including credentials, browsing history, and preferences, and are typically targeted by malware for data exfiltration or credential theft. The rule leverages causality fields for investigation into the actor and the causal process.
Identifies `grep` or `findstr` utilizing decoded regex patterns searching for cloud environment variables locally, specifically looking for patterns like AKIA (AWS Access Key ID), xoxb (Slack Bot User OAuth Token), ghp_ (GitHub Personal Access Token), or npm_ (NPM Access Token). This activity is then correlated with network connections to a specific IP address (216.126.225.129), which is associated with the Megalodon CI/CD malware.
Page 132 of 206