Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects automated credential spraying and lateral movement attempts using the sshpass utility targeting common Oracle/PeopleSoft usernames. This specific combination of parameters and targeted accounts matches the bash script deployment mechanism utilized by the ShinyHunters extortion gang.
Detects SMB NTLM relay attacks used for credential capture and lateral movement
Detects access to the Intune admin portal from devices that are not marked as compliant or lack a device ID. This may indicate potential credential theft, session replay from unmanaged infrastructure, or AiTM phishing proxies bypassing basic MFA.
This rule detects potential Kerberos Golden Ticket attacks by identifying Kerberos authentication service (AS) request events (EventID 4768) where the ticket encryption type is 0x17 (RC4-HMAC) and the difference between the event generation time and the ticket's start time is greater than one day. This large time difference can indicate a forged ticket with an invalid timestamp, a common characteristic of Golden Tickets. The rule then summarizes these events by target username and computer, flagging instances where three or more such events occur.
Detects attempts to list, read, create, update, or delete Kubernetes secrets via the Kubernetes API server. This activity could indicate an adversary attempting to gain access to sensitive information or manipulate the environment.
Detects unauthorized access to KeePass password database files
Detects download of password wordlists or hash dumps for offline cracking
Detects installation of password filter DLLs to intercept plaintext passwords
This rule detects potential 'impossible travel' scenarios within Azure AD sign-in logs. It identifies users who successfully sign in to Office 365 from two geographically distant IP addresses within a one-hour window, suggesting a potential compromise or an attempt to bypass security controls.
Detects unauthorized access to KeePass password database files
Detects when the same SessionId is used to sign in from more than one location across interactive and non-interactive sign-ins.
This rule detects a pattern indicative of password spraying or brute force attacks against user accounts. It identifies instances where a single user principal name (UPN) and IP address combination has at least 5 failed sign-in attempts and at least 1 successful sign-in attempt within a 30-minute window. This combination of failed and successful logins from the same source for the same user suggests an attacker successfully guessed a password after multiple attempts, or a password spraying attack where one of the sprayed passwords was correct.
This rule detects modifications to registry keys related to the Local Security Authority (LSA) or Security Account Manager (SAM). Such modifications, indicated by Event ID 4657, can be a sign of privilege escalation attempts, credential dumping, or other malicious activities aimed at compromising system security.
This rule detects suspicious command-line activity indicative of potential token impersonation or theft. It specifically looks for the keywords 'token' or 'impersonate' within process creation command lines (EventID 4688) and triggers an alert if these keywords appear 3 or more times within an hour on the same computer by the same account. This could indicate an adversary attempting to manipulate access tokens to elevate privileges or operate under a different security context.
This rule detects a high volume of failed object access attempts (EventID 4674) by a single user on a specific computer within a one-hour window. This could indicate an adversary attempting to discover or access sensitive resources, potentially as part of privilege escalation or data exfiltration efforts.
This rule searches CI logs and commands for patterns that extract GitHub secret values where isSecret is true. Automated secret scraping in pipelines leads to repository takeover. Audit workflow YAML changes. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects when a single caller performs multiple (3 or more) retrievals of Azure Storage Account Keys within a one-hour window. This activity can indicate an attempt to gain unauthorized access to storage resources or exfiltrate data.
Identifies inbound remote RPC calls targeting the Remote Registry interface to save registry keys (OpNums 20 and 31). This is frequently abused for remote credential dumping of SAM/LSA secrets.
This rule detects attempts to manipulate access tokens via a remote SMB session. Specifically, it looks for the string "ImpersonateLoggedOnUser" within TCP traffic destined for port 445 (SMB). This activity could indicate an attacker attempting to elevate privileges or move laterally by impersonating a logged-on user.
This rule detects potential memory injection attempts on Linux systems via an SSH session. It specifically looks for the strings "/proc/" and "/mem" within TCP traffic directed to an SSH server ($HOME_NET 22). This combination of strings suggests an attempt to access or manipulate process memory, which is a common technique used by attackers for privilege escalation or code injection.
This rule detects when a single caller performs multiple (3 or more) retrievals of Azure Storage Account Keys within a one-hour window. This activity can indicate an attempt to gain unauthorized access to storage resources or exfiltrate data.
Page 134 of 206