Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
This rule detects network traffic on port 445 (SMB) containing the strings "Network Providers" and "ProviderPath" (case-insensitive). This pattern is indicative of an attempt to register a malicious Network Provider DLL for credential capture, a technique used by adversaries to persist and steal credentials.
This rule detects attempts to download files that appear to be password hash lists or wordlists, often used for offline credential cracking. It specifically looks for HTTP URIs containing keywords like 'rockyou', 'passwords', 'wordlist', or 'hashlist' followed by '.txt', and only triggers if the downloaded file size is greater than 10,000 bytes. This activity is indicative of an attacker attempting to exfiltrate or acquire data for credential access.
This rule detects attempts to dump the Security Account Manager (SAM) hive using the 'reg save' command over HTTP. Specifically, it looks for HTTP requests containing 'reg save' and 'HKLM\SAM' in the URI, indicating an attempt to extract credential information from a Windows system.
This rule detects attempts to harvest Group Policy Preferences (GPP) credentials from the SYSVOL share over SMB. It specifically looks for network traffic on port 445 (SMB) containing the strings "SYSVOL" and "Groups.xml" in a case-insensitive manner, indicating a potential attempt to access the file where GPP credentials might be stored.
This rule detects attempts to harvest private key files (with extensions like .key, .pem, .p12, .pfx, .pkcs12) via HTTP requests, often indicative of a web shell being used to exfiltrate sensitive cryptographic material from a compromised server. The detection is based on the URI of the HTTP request.
This rule detects attempts to read AutoLogon credentials from the Windows Registry over the network, specifically targeting SMB (port 445) traffic. It looks for the strings 'DefaultPassword' and 'Winlogon' in a case-insensitive manner within the TCP payload, indicating a potential attempt to extract stored credentials used for automatic login.
This rule detects attempts to access secrets stored in Google Cloud Platform (GCP) Secret Manager via its API. It specifically looks for HTTP traffic directed to 'secretmanager.googleapis.com' with a URI path containing '/versions/' and ':access', indicating an attempt to access a specific secret version.
This rule detects attempts to retrieve secret values from AWS Secrets Manager. It specifically looks for HTTP requests to 'secretsmanager.amazonaws.com' containing 'GetSecretValue' in the URI. This activity could indicate an attacker attempting to access sensitive credentials.
This rule detects attempts to access Kubernetes secret objects via the Kubernetes API. It specifically looks for HTTP requests to the '/api/v1/namespaces/' path followed by '/secrets' on port 8080. This activity could indicate an attacker attempting to exfiltrate sensitive information stored in Kubernetes secrets.
This rule detects network traffic indicative of a domain account being used for lateral movement via SMB. It specifically looks for NTLMSSP authentication within SMB traffic directed to port 445 on the home network, containing the string 'domain' (case-insensitive). A threshold of 10 occurrences within 60 seconds from the same source IP triggers the alert, suggesting a potential brute-force or rapid access attempt.
This rule detects attempts to exploit the Zerologon (CVE-2020-1472) vulnerability, a critical privilege escalation flaw in Microsoft's Netlogon Remote Protocol. It specifically looks for network traffic on TCP port 445 (SMB) containing the 'NetrServerAuthenticate3' function call with a specific sequence of null bytes, which is indicative of an unauthenticated Netlogon session setup without signing and sealing, a key characteristic of the Zerologon exploit.
This rule detects HTTP requests to a server that contain both 'password' and 'username' in the URI, case-insensitively. This pattern is indicative of a potential credential harvesting attempt where an attacker is trying to collect user credentials via a crafted web page or phishing site. The rule specifically looks for these keywords in the URI of an established HTTP connection flowing to the server.
This rule detects Kerberoasting activity, specifically looking for multiple Kerberos Ticket Granting Service (TGS) requests over UDP port 88 within a short timeframe from the same source IP. Kerberoasting is a post-exploitation technique used by attackers to obtain service principal name (SPN) hashes, which can then be cracked offline to retrieve the associated plaintext passwords. The rule uses a threshold of 20 TGS requests within 10 seconds from a single source to identify this suspicious behavior.
This rule detects explicit references to popular PowerShell credential dumping tools, specifically 'Invoke-Mimikatz' and 'Invoke-Kerberoast', within executed PowerShell commands. It leverages native Defender XDR PowerShell command logging to identify these suspicious activities, which are indicative of credential access attempts.
Detects successful device code flow sign-ins to the Microsoft Authentication Broker application targeting the Microsoft Graph resource, specifically when the sign-in does not originate from a trusted named location. This activity can indicate a device code phishing attempt where an attacker tricks a user into authenticating a malicious application.
Detects successful sign-ins to Microsoft Office applications using the device code flow (FOCI AppId d3590ed6-52b3-4102-aeff-aad2292ab01c) that originate from an untrusted network location. This activity can indicate a device code phishing attack where an adversary has tricked a user into authenticating a malicious application.
This rule detects suspicious activity related to OpenSSL or certificate manipulation by identifying processes that execute commands containing 'openssl' or 'certificate' keywords. It aggregates these activities by computer and account within one-hour bins and flags if three or more such activities occur, which could indicate credential access attempts or system misconfiguration.
Detects addition of credentials to Azure service principals for persistence
Detects reuse of alternate authentication materials like tokens or cookies
This rule detects potential Pass-the-Hash (PtH) attacks by looking for multiple successful network logons (LogonType 3) using NTLM authentication for the same user from the same IP address. A count of 5 or more such events is considered suspicious.
Detects multiple failed Kerberos pre-authentication attempts (EventID 4771 with status codes 0x18 or 0x1f) from a single IP address against a target user within a short timeframe (20 attempts in 5 minutes). This pattern is indicative of a brute-force attack against Kerberos accounts.
Page 139 of 206