Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects when a web browser (Chrome, Edge, Firefox, Brave, Opera) initiates a process that is not another instance of itself. This could indicate a drive-by download, execution of malicious code, or other suspicious activity originating from a browser.
This rule detects suspicious activity related to accessing or dumping the NTDS.dit file, which contains Active Directory credential information. It looks for process creation events involving tools commonly used for NTDS.dit extraction (e.g., ntdsutil, secretsdump), file access events on NTDS.dit paths, and privilege use (SeBackupPrivilege, SeRestorePrivilege, SeDebugPrivilege) often associated with credential dumping.
This rule detects potential credential abuse of service principals or applications by identifying an unusual number of activities from a single service principal or application across multiple distinct IP addresses within a one-hour window. It specifically monitors sign-in logs for applications like 'Azure CLI', 'GitHub', or 'CustomApp' where the user type is 'ServicePrincipal' or 'Application'. A threshold of more than 10 activities and more than 2 distinct IP addresses within an hour triggers an alert.
This rule detects suspicious activity involving API key rotation followed by high usage. It correlates audit logs for API key operations (rotate, update, create) with cloud application events showing API requests or token usage. Specifically, it looks for instances where an API key is rotated, updated, or created, and then subsequently used more than 50 times within a day by the same actor. This could indicate an adversary gaining access to an API key and then rapidly utilizing it for malicious purposes.
Detects the execution of the GitHub CLI command used to print the active authentication token, which is abused by the Shai-Hulud worm to steal developer credentials.
Detects when OAuth applications are added to trusted lists or granted Context-Aware Access (CAA) exemptions within Google Workspace. This activity bypasses user consent screens and CAA policies, potentially allowing malicious applications to gain unauthorized access. The rule also tracks permission escalation for existing applications via 'CHANGE_APP_ACCESS' events.
This rule detects attempts to purchase code signing certificates by monitoring HTTP traffic for connections to known certificate authorities (Sectigo, Comodo, Digicert) and the presence of the term 'codesigning' in the URI. This could indicate an adversary attempting to acquire legitimate code signing certificates for malicious purposes, such as signing malware to evade detection.
This rule detects potential credential harvesting attempts by monitoring HTTP POST requests that contain both 'password' and 'email' in the client body. It specifically looks for these keywords in a case-insensitive manner within the HTTP client body and requires the body size to be greater than 50 bytes. This indicates a form submission likely containing sensitive user credentials.
This rule detects HTTP requests that appear to be credential phishing attempts, specifically looking for pages that might also attempt to bypass multi-factor authentication (MFA). It triggers when an HTTP URI contains the keywords "token", "verify", and "auth" (case-insensitive). This combination of keywords in the URI suggests a page designed to collect credentials and potentially an MFA bypass token.
This rule detects suspicious post-exploitation activity originating from the BeyondTrust/Bomgar session process, `bomgar-scc.exe`. It identifies the execution of common Windows command-line interpreters and scripting environments (`cmd.exe`, `powershell.exe`, `pwsh.exe`, etc.) or the presence of specific command-line substrings indicative of privilege escalation, credential access, reconnaissance, lateral movement, defense evasion (like log clearing), or download/execution cradles. The rule assigns a risk score based on the detected activities and triggers an alert if the cumulative score and unique child process count exceed predefined thresholds, suggesting a high-confidence post-exploitation scenario.
This rule detects HTTP POST requests that contain the string "creds" in the URI and have a data size greater than 200 bytes. This pattern is indicative of potential browser credential exfiltration, where an attacker or malicious software attempts to send stolen credentials to a remote server.
Remote LSASS Memory Dump via SMB
Suricata
This rule detects attempts to remotely dump the LSASS process memory over SMB. It specifically looks for the string "lsass.exe" within TCP traffic destined for port 445 (SMB) on the home network. This activity is indicative of an attacker trying to extract credentials from a compromised system.
This rule detects an attempt to escalate privileges on a system via SSH by looking for the string "sudo su" within an established TCP connection to port 22 (SSH). This indicates a user is trying to switch to the root user or another user with elevated privileges using the sudo command.
This rule detects RDP credential spraying attempts targeting multiple usernames on a single destination IP address. It triggers an alert if 30 or more RDP connection attempts are made to the same destination within a 60-second window, indicating a potential brute-force or credential-stuffing attack against RDP services.
This rule detects the transmission of cleartext credentials over Telnet by looking for the string "Password:" in traffic flowing to the server on port 23. Telnet is an insecure protocol that sends data, including login credentials, in plain text, making it vulnerable to eavesdropping.
This rule detects the transmission of cleartext credentials over FTP by looking for the "PASS " string in network traffic flowing to an FTP server on port 21. This indicates that a password is being sent without encryption, which is a security risk.
SMB Authentication Brute Force
Suricata
This rule detects SMB authentication brute force attempts by looking for multiple NTLMSSP_AUTH messages over port 445 (SMB) from the same source IP within a 30-second window. A threshold of 10 attempts triggers the alert, indicating a potential brute force attack against SMB authentication.
This Suricata rule detects potential data exfiltration of password store information over HTTP. It specifically looks for HTTP POST requests where the client body contains both the words "password" and "username" (case-insensitive) and the body size is greater than 1000 bytes. This pattern suggests an attempt to send sensitive credential data from a compromised system to a remote server.
This rule detects network activity associated with password cracking tools like Hashcat or John the Ripper. It specifically looks for HTTP user agent strings containing "hashcat" or "john.the.ripper" in traffic flowing to a server.
This rule detects the delivery of a payload containing the strings "SpAcceptCredentials" and "hook" within HTTP response body data. This pattern is indicative of an SSPI credential hooking attempt, where an attacker tries to intercept or steal credentials by injecting malicious code into the Security Support Provider Interface (SSPI) process. The detection is focused on traffic flowing from the server to the client.
This rule detects the presence of an API hooking payload within HTTP response data, specifically looking for the strings "SetWindowsHookEx" and "WH_KEYBOARD" (case-insensitive). This combination suggests an attempt to intercept keyboard input, which is a common technique used by malware for credential interception.
Page 145 of 206