Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects the execution of the zenity dialog tool spawned by unusual parents (like IDEs or bash scripts) to create fake password prompts on Linux. The Linux variant of UNK_DeadDrop utilizes this to trick developers into providing their system passwords, enabling root access and GNOME Keyring extraction.
This rule detects attempts to harvest credentials using a fake Microsoft login page. It triggers when HTTP traffic from the server to the client contains both "microsoftonline" and "password" in the file data, and the HTTP host is an IP address. This combination suggests a phishing attempt where a malicious server is impersonating a Microsoft login page to capture user credentials.
This Suricata rule detects Kerberos unconstrained delegation abuse by looking for a specific byte sequence in UDP traffic destined for port 88 (Kerberos). The byte sequence '|a0 03 02 01 05 a1 03 02 01 0d|' is indicative of a specific Kerberos message structure that can be associated with unconstrained delegation. Unconstrained delegation allows a service to impersonate any user to any other service on the network, which can be abused by attackers for privilege escalation and lateral movement.
This rule detects potential session cookie theft and bulk cookie exfiltration by monitoring HTTP traffic for large cookie sizes (greater than 500 bytes) being sent from the internal network to external servers. A threshold of 20 such events within 60 seconds from a single source IP triggers the alert, indicating suspicious activity that could be related to an attacker exfiltrating stolen session cookies.
This rule detects attempts to exploit a Local File Inclusion (LFI) vulnerability to read the Windows Security Account Manager (SAM) database. It specifically looks for HTTP requests containing the string "\windows\system32\config\sam" in the URI, which is a common path for the SAM file on Windows systems. Successful exploitation of such a vulnerability could lead to the disclosure of hashed user credentials.
This rule detects potential NTLM Relay attacks over SMB. It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, and within that traffic, it identifies the presence of both the SMB protocol signature ('|FF|SMB') and the NTLMSSP (NTLM Security Support Provider) signature. This combination suggests an attempt to relay NTLM authentication.
This rule detects an FTP brute force attempt by monitoring TCP connections to port 21 (FTP) on the home network. It triggers an alert if 20 or more TCP SYN packets (indicating new connection attempts) are observed from the same source IP address within a 60-second window. This behavior is indicative of an attacker repeatedly trying to guess FTP credentials.
This rule detects Address Resolution Protocol (ARP) spoofing attempts by looking for ARP reply packets (opcode 2) on the network. A threshold is applied to trigger an alert if 20 or more ARP replies are observed from the same source within a 10-second window, which is indicative of malicious ARP activity.
This rule detects potential credential abuse of service principals or applications by identifying an unusual number of activities from a single service principal or application across multiple distinct IP addresses within a one-hour window. It specifically monitors sign-in logs for applications like 'Azure CLI', 'GitHub', or 'CustomApp' where the user type is 'ServicePrincipal' or 'Application'. A threshold of more than 10 activities and more than 2 distinct IP addresses within an hour triggers an alert.
This rule detects attempts to modify SSH authorized_keys files over a network connection, which could indicate an attacker establishing backdoor access. It specifically looks for the string "authorized_keys" within TCP traffic destined for port 22 (SSH).
This rule detects a suspicious sequence of events in Okta that could indicate a help-desk social engineering attack or account takeover. Specifically, it looks for a user's password being reset, followed by the enrollment of a new MFA factor or device for that same user, all occurring within a short time frame (1 hour) and potentially from distinct session IDs or device hashes. This pattern suggests an attacker has gained initial access (e.g., via social engineering the help desk) and is immediately attempting to establish persistence by enrolling their own MFA device.
Detects suspicious attempts to dump serialized GitHub Actions secrets (JSON) into a text file named 'format-results.txt' for subsequent artifact exfiltration, a technique used by IronWorm. The rule looks for shell commands that use 'echo' to write to 'format-results.txt' and contain references to 'VARIABLE_STORE' or 'secrets', indicating an attempt to exfiltrate sensitive CI/CD environment variables.
Detects a Node.js or npm process attempting to read sensitive credential files such as SSH keys, npm tokens, K8s configurations, cloud credentials, or Vault material. This rule is tuned for the Red Hat Cloud Services supply chain attack by monitoring for Node.js/npm processes executing in the context of the affected packages or preinstall hooks.
Detects the execution of `cg.exe`, a secondary Python executable dropped by SilentRunLoader specifically to pack and steal Chrome browser data. This behavior is indicative of TA4922 activity.
Detects processes attempting to scrape unmasked CI runner secrets from memory, specifically looking for techniques used by the Miasma worm to bypass GitHub Actions secret masking. This rule identifies suspicious command-line patterns indicative of secret extraction, such as searching for 'isSecret' or accessing '/proc/mem' with Python.
Detects command-line attempts to access, dump, or export macOS Keychain data using the 'security' utility. This behavior is commonly exhibited by infostealers, such as MacSync Stealer, targeting saved passwords, cryptocurrency wallets, and developer credentials.
This rule detects potential Kerberos Constrained Delegation attacks by monitoring Security Event ID 4769 (A Kerberos service ticket was requested) for tickets with the '0x80000000' option, which indicates a forwardable ticket. The rule then aggregates these events by target username, client address, and IP address, flagging instances where 8 or more such tickets are requested, which could indicate an attempt to abuse constrained delegation.
This rule detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory or the NTDS.dit file, which are common targets for credential dumping. It specifically looks for Security Event ID 4656 (A handle to an object was requested) where the ObjectName is either 'lsass.exe' or 'ntds.dit' and the AccessMask indicates read or all access permissions. The rule then summarizes these events by user, computer, and IP address, flagging if two or more such events occur.
Detects activity where one K8s client accesses many secrets in a short span.
This could be indicative of Credential access, working towards Privilege Escalation.
This could be indicative of Credential access, working towards Privilege Escalation.
Detects suspicious activity related to OAuth2PermissionGrant operations, specifically looking for a high volume of successful consent grants by a single user within a short timeframe. This could indicate an attacker attempting to gain broad access to resources by granting permissions to a malicious OAuth application.
Detects suspicious activity involving multiple password resets for different users initiated by a single user within a one-hour timeframe in Azure AD. This could indicate an attacker attempting to gain control over multiple accounts.
Page 144 of 206