Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,437
11,828
5,872
5,150
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects LDAP-based modification of authentication configurations for credential theft
This rule detects potential Kerberos 'Pass the Ticket' (PtT) attacks, specifically focusing on the reuse of Kerberos Ticket Granting Tickets (TGTs). It triggers when UDP traffic to port 88 (Kerberos) on the home network contains the byte sequence '|6b|' at the beginning of the payload, and this activity occurs 10 times within 5 seconds from the same source IP. The '6b' byte often indicates a Kerberos AP-REQ message, which is used to request access to a service. Repeated AP-REQ messages from the same source could indicate TGT reuse.
This rule detects a replication request to a Domain Controller (DC) containing the string "DsGetNCChanges" over TCP port 389 (LDAP). This specific string is associated with Active Directory replication. The rule is designed to identify potential rogue Domain Controllers attempting to replicate with legitimate DCs, which could indicate an attacker trying to establish a malicious DC for credential harvesting or other attacks. A threshold of 3 occurrences within 60 seconds from the same source IP is set to reduce false positives.
This rule detects attempts to access the Security Account Manager (SAM) database remotely over Server Message Block (SMB). It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, containing the string "\SAM" (case-insensitive) and "NtOpenFile" (case-insensitive). This combination suggests an attempt to open the SAM database file, which could indicate credential access attempts.
This rule detects the delivery of a fake GUI login prompt over HTTP, likely for credential capture. It looks for HTTP responses (flow:to_client) containing the strings "ShowDialog", "Password", and "GetWindowText" (case-insensitive) within the file data. This combination of keywords suggests an attempt to mimic a legitimate login interface to trick users into providing their credentials.
This rule detects attempts to access sensitive credential-related files (e.g., configuration files, credential files, .env files, or files containing 'secret') via HTTP requests. This pattern is often associated with web shell activity where an attacker tries to exfiltrate sensitive information from a compromised web server.
This rule detects potential MFA bypass attempts using Evilginx by looking for HTTP POST requests to the server that contain both 'session' and 'token' in the URI, with a body size greater than 100 bytes. This pattern is indicative of session token capture, a technique used by Evilginx to bypass multi-factor authentication.
This rule detects attempts at token impersonation by looking for the strings "ImpersonateLoggedOnUser" and "DuplicateTokenEx" within HTTP response bodies. This technique is often used by attackers to elevate privileges by impersonating a logged-on user's security token.
This rule detects suspicious activity related to Microsoft Teams chat messages being scraped for credentials. Specifically, it looks for HTTP requests to 'graph.microsoft.com' with URIs containing '/chats/' and '/messages'. A threshold of 20 such requests within 60 seconds from a single source IP triggers the alert, indicating potential automated data exfiltration or credential harvesting from Teams chats.
This rule detects attempts to copy the Active Directory Certificate Services (ADCS) certificate database for offline forgery. Specifically, it looks for SMB traffic to a server on port 445 (SMB) containing the string "certnew.cer" (case-insensitive) in the content, indicating a file transfer of a newly issued certificate. This activity is often associated with credential access techniques, where an attacker might exfiltrate certificate data to forge credentials.
This rule detects attempts to abuse Active Directory Certificate Services (AD CS) by requesting certificates through the /certsrv/ interface. Specifically, it looks for HTTP requests containing both '/certsrv/' and 'request' in the URI, indicating a certificate enrollment request. The thresholding mechanism (5 requests from the same source within 60 seconds) aims to reduce false positives and highlight potentially automated or repeated attempts to exploit AD CS.
This rule detects a potential MFA SMS code request flooding attack. It triggers when a single source IP address makes 10 or more HTTP requests containing the string "send_code" in the URI within a 60-second window. This behavior is indicative of an attacker repeatedly attempting to request MFA codes, likely in an attempt to overwhelm the user or the system, or to facilitate a SIM-swapping attack.
This rule detects potential unauthorized access attempts using forged web credentials. It specifically looks for HTTP requests containing a cookie with a long, base64-like encoded string (100 or more characters) which could indicate a forged session token or credential. A threshold of 10 such occurrences within 5 seconds from the same destination IP address triggers the alert, suggesting a brute-force or automated credential stuffing attempt.
This rule detects the use of a Silver Ticket for SMB service authentication. A Silver Ticket is a forged Kerberos service ticket that allows an attacker to authenticate to a specific service (like SMB) on a specific server without needing to interact with the Domain Controller. The rule looks for TCP traffic on port 445 (SMB) containing both 'NTLMSSP' and 'KRB5' content, indicating a Kerberos authentication attempt that might be a Silver Ticket. A threshold is applied to prevent excessive alerts.
This rule detects a Silver Ticket attack, specifically looking for forged Kerberos service tickets. It inspects UDP traffic on port 88 (Kerberos) for specific byte sequences indicative of a forged ticket. The content '|6b|' at depth 1 and '|a0 03 02 01 05|' are specific patterns associated with the structure of a Kerberos ticket, which when combined, suggest a malicious attempt to authenticate to a service without proper credentials.
Detects high-volume POST requests to login forms indicating credential harvesting
Detects access to AWS credentials files for cloud account credential theft
Detects download of password wordlists or hash dumps for offline cracking
This rule detects an unusually high number of process creations using 'RunAs' within a one-hour window by a single user. A count of 5 or more 'RunAs' commands within an hour could indicate an attempt at privilege escalation or lateral movement, potentially by an attacker trying to execute commands with different user contexts.
This rule detects attempts to perform SID History Injection via DCSync Replication. Specifically, it looks for TCP traffic on port 445 (SMB) directed to the home network, containing the string "DsAddSidHistory" case-insensitively. This activity is indicative of an attacker attempting to add a Security Identifier (SID) from another account to a target account's SIDHistory attribute, often as part of a privilege escalation technique like DCSync attacks, to gain unauthorized access or maintain persistence within an Active Directory environment.
This rule detects when the 'sIDHistory' attribute is added to a domain account. This is a common technique used in privilege escalation, particularly in Active Directory environments, where an attacker adds the SID of a highly privileged account (like a Domain Admin) to a compromised account's sIDHistory. This grants the compromised account the privileges of the added SID without changing its primary SID.
Page 137 of 206