Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
This rule detects potential Golden Ticket attacks by looking for multiple successful Kerberos authentication events (EventID 4624) with LogonType 3 (network logon) and a specific TicketEncryptionType (0x17), originating from the same IP address and targeting the same user, within a short timeframe and with a long ticket lifetime. A Golden Ticket attack involves an adversary forging Kerberos Ticket Granting Tickets (TGTs) to gain unauthorized access to resources.
This rule detects attempts to read the 'cpassword' field from Group Policy Preferences XML files over SMB. The 'cpassword' field was historically used to store encrypted passwords, which could be easily decrypted, leading to credential exposure. Detection of this string in SMB traffic indicates an attempt to access or exfiltrate these sensitive credentials.
This rule detects potential account takeover attempts by identifying the replay of stolen session cookies. It specifically looks for HTTP traffic from the home network to any destination, where the HTTP cookie header contains the case-insensitive string "session". A threshold of 5 occurrences within 3 seconds, tracked by destination, is used to trigger an alert, indicating a rapid succession of session cookie replays.
This rule detects potential persistence mechanisms related to browser extensions. It looks for processes launching Chrome or Edge with the '--load-extension' command-line argument, which can be used to load unpacked extensions. Additionally, it monitors registry modifications to 'ExtensionInstallForcelist' that contain 'http' or 'crx', indicating a forced installation of an extension, potentially from a remote source or a local file.
This rule detects suspicious GitHub workflow modifications or pushes originating from multiple distinct IP addresses within a short time frame (1 hour). It specifically looks for 'WorkflowCreated', 'WorkflowUpdated', or 'Push' actions on GitHub, and triggers if more than one such event and more than one distinct IP address are observed for a given account within an hour. This could indicate compromised credentials or unauthorized access to a GitHub account being used to manipulate CI/CD pipelines.
This rule detects multiple attempts by a user account to perform a Directory Synchronization (DirSync) operation, which is a common indicator of a DCSync attack. The rule specifically looks for Event ID 4662 with properties containing 'DS-DirSync' or '131072', filters for user accounts, excludes known service accounts, and triggers if there are 5 or more attempts from the same account and computer.
Detects download of UAC bypass and elevation control bypass tools
Detects generic phishing pages serving credential capture forms to victims
Detects inbound RPC calls to the Windows Remote Registry interface using operation numbers associated with registry save/backup operations, which may indicate credential dumping via remote registry access. This rule specifically looks for RPC UUID '338cd001-2244-31f1-aaaa-900038001003' and operation numbers 20 or 31, which correspond to registry save/backup functions.
Detects suspicious Azure PIM role activation requests for temporary elevated access
This rule detects network traffic containing the strings "CreateProcessWithTokenW" and "MAXIMUM_ALLOWED" in HTTP client data. This combination of strings is indicative of a payload attempting a privilege escalation technique, specifically leveraging the Windows API function CreateProcessWithTokenW, often used in conjunction with token manipulation to achieve higher privileges. The `flow:to_client` indicates that the payload is being sent from the server to the client, suggesting a potential download or response containing the malicious code.
This rule detects attempts to query the Windows Registry remotely for the 'HKLM\Software\RealVNC' key over TCP port 445 (SMB). This activity is indicative of an attacker attempting to locate stored credentials, specifically those related to RealVNC, which could then be used for further lateral movement or privilege escalation. The detection is based on the presence of the string 'HKLM\Software\RealVNC' in the network traffic.
Detects potential session replay attacks indicative of Kali365 and other AitM (Adversary-in-the-Middle) proxying phishing kits. This rule isolates successful user logins containing a SessionId. To fully operationalize this for AitM detection, defenders must utilize SIEM-based correlation (e.g., statistical or window-based queries) to track a single SessionId originating from multiple geographically disparate IP addresses within a short timeframe.
This rule detects a DCSync attack by looking for the "DsGetNCChanges" string in TCP traffic on port 389 (LDAP). DCSync is a technique used by attackers to simulate a domain controller and request directory replication, allowing them to extract password hashes and other sensitive information from Active Directory.
This rule detects HTTP password spray attacks where an attacker attempts to log in to multiple user accounts on a web application using a common password. It specifically looks for HTTP POST requests to a URI containing 'login' and triggers an alert if 30 such requests are observed within 60 seconds, tracked by the destination IP address.
This rule detects potential session hijacking attempts by monitoring HTTP traffic for unusually long cookie values. Specifically, it looks for HTTP cookies containing base64-like strings (alphanumeric characters, plus, slash, and equals signs) that are 100 characters or longer. A threshold of 5 such occurrences within 3 seconds from the same destination IP address triggers the alert, indicating a possible attempt to use a stolen browser session cookie.
Detects enumeration of git credential helpers via 'git config --global credential.helper'. This command is used by adversaries, such as Miasma, to determine how credentials are stored (e.g., wincred, osxkeychain, store) before attempting extraction.
This rule detects suspicious device registration operations in a tenant by identifying device names that match known automated device code phishing kit patterns. Specifically, it looks for device names that are in the format of 'DESKTOP-' followed by 6 to 8 hexadecimal characters, which deviates from typical Windows default naming conventions. This pattern is often used by attackers to register devices for persistence or to bypass MFA.
This rule detects attempts to grep for passwords within the bash history file over an SSH connection. Specifically, it looks for the string 'grep -i password ~/.bash_history' in TCP traffic destined for port 22 (SSH). This activity is indicative of an attacker attempting to discover credentials on a compromised system.
This rule detects HTTP requests that contain both 'otp' and 'verify' in the URI, which is indicative of a phishing page designed to capture One-Time Passwords (OTP) or Multi-Factor Authentication (MFA) codes. The rule is specifically looking for patterns associated with reverse proxy phishing techniques.
This rule detects potential exfiltration of password manager database files over HTTP. It specifically looks for HTTP POST requests with a URI containing common password manager names (keepass, lastpass, 1password, bitwarden) and a data size greater than 1000 bytes. This combination suggests a large file, potentially a database, is being uploaded.
Page 135 of 206