Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
This rule detects attempts to access SSH private key files (id_rsa, id_dsa, id_ecdsa, or .pem files) via HTTP. It specifically looks for these file extensions or names in the HTTP URI, indicating a potential exposure of sensitive SSH credentials on a web server.
This rule detects HTTP requests for the '.env' file, which often contains sensitive environment variables and credentials. An attacker successfully retrieving this file could gain access to critical system information, API keys, database credentials, and other secrets, leading to further compromise. The rule specifically looks for the string '/.env' in the HTTP URI, indicating an attempt to access this configuration file.
This rule detects the exfiltration of AWS temporary credential tokens over HTTP. It specifically looks for HTTP client body content containing both "ASIA" (which is a common prefix for AWS temporary access keys) and "aws_session_token" (the parameter name for the session token). The detection is case-insensitive and targets established HTTP connections where data is flowing from the client to the server.
This rule detects the exfiltration of a GitHub Personal Access Token (PAT) over HTTP. It specifically looks for the string "ghp_" in the client body of HTTP traffic, which is a common prefix for GitHub PATs. The rule is designed to identify instances where a PAT might be sent from an internal network to an external server, indicating potential credential compromise or data exfiltration.
This rule detects ARP cache poisoning attempts by identifying multiple ARP responses (opcode 2) for the same IP address within a short time frame (15 responses in 5 seconds from the same source). This behavior is indicative of an attacker attempting to redirect network traffic by sending forged ARP replies.
Detects access or creation of files within Google Drive that have credential-related names, indicating potential credential harvesting attempts or unauthorized access to sensitive data. The rule specifically looks for file events such as 'view', 'edit', 'create', or 'access_url' on files whose titles contain keywords commonly associated with credentials (e.g., password, secret, key, token, etc.).
This rule detects a pattern indicative of password spraying or brute force attacks against user accounts. It identifies instances where a single user principal name (UPN) and IP address combination has at least 5 failed sign-in attempts and at least 1 successful sign-in attempt within a 30-minute window. This combination of failed and successful logins from the same source for the same user suggests an attacker successfully guessed a password after multiple attempts, or a password spraying attack where one of the sprayed passwords was correct.
Detects attempts to read common HashiCorp Vault token paths from the filesystem, indicating potential credential harvesting by the Miasma stealer or other unauthorized access.
Detects successful interactive device-code flow sign-ins through the Microsoft Authentication Broker application (Client ID 29d9ed98-a469-4536-ade2-f981bc1d605e). Tycoon 2FA operators frequently abuse this specific flow to bypass multi-factor authentication and steal session tokens.
This rule detects suspicious activity involving Azure AD device registration followed by a sign-in from the same user and IP address, particularly when the user agent strings are indicative of non-standard clients (e.g., 'node', 'axios', 'undici', 'node-fetch'). This pattern can indicate an adversary attempting to establish persistence or bypass multi-factor authentication by registering a new device and then immediately using it for access.
This rule detects suspicious GitHub workflow modifications or pushes originating from multiple distinct IP addresses within a short time frame (1 hour). It specifically looks for 'WorkflowCreated', 'WorkflowUpdated', or 'Push' actions on GitHub, and triggers if more than one such event and more than one distinct IP address are observed for a given account within an hour. This could indicate compromised credentials or unauthorized access to a GitHub account being used to manipulate CI/CD pipelines.
This rule detects when a credential (password) is added to an Azure Service Principal. This activity is identified by monitoring HTTP traffic for requests to 'graph.microsoft.com' containing 'addPassword' in the URI. This could indicate an attacker establishing persistence by adding new credentials to an existing service principal.
This rule detects attempts to search for sensitive keywords like 'password', 'secret', 'credential', 'creds', 'apikey', 'token', or 'key' using 'findstr.exe' or 'reg.exe'. This activity can indicate an adversary attempting to discover credentials or other sensitive information on a compromised system.
This rule detects potential cloud API access using a stolen token by monitoring HTTP requests to AWS S3, Azure management, or Google APIs that contain an 'Authorization: Bearer' header. A threshold of 50 such requests within 10 seconds from the same source IP triggers the alert, indicating a possible brute-force or high-volume access attempt with a compromised token.
This rule detects potential rogue captive portal credential harvesting pages by inspecting HTTP responses for the presence of keywords like 'captive', 'password', and 'connect' within the file data. These keywords, when found together in a client-bound HTTP response, suggest an attempt to mimic a legitimate captive portal to steal user credentials.
This rule detects attempts to capture credentials via an 'Evil Twin' access point by looking for HTTP POST requests to URIs containing both 'login' and 'wifi'. This combination suggests a malicious captive portal designed to trick users into submitting their credentials.
This rule detects when a user adds mailbox permissions to three or more mailboxes within a one-hour window in Exchange Online. This behavior can indicate an adversary attempting to gain persistent access to multiple mailboxes, often for data exfiltration or further compromise.
This rule detects suspicious activity involving API key rotation followed by high usage. It correlates audit logs for API key operations (rotate, update, create) with cloud application events showing API requests or token usage. Specifically, it looks for instances where an API key is rotated, updated, or created, and then subsequently used more than 50 times within a day by the same actor. This could indicate an adversary gaining access to an API key and then rapidly utilizing it for malicious purposes.
This rule detects high-volume access to Azure Key Vault secrets, keys, or certificates within a one-hour window. It specifically looks for successful read operations on secrets, keys, and certificates, as well as modifications to access policies. A high volume (more than 10 accesses) from a single caller within an hour is flagged as potential credential harvesting.
GitHub CLI Token Extraction
Cortex XDR
Detects the execution of `gh auth token` which is used by the Shai-Hulud malware to steal the active GitHub Personal Access Token (PAT). This rule specifically looks for the `gh.exe` or `gh` process executing with command-line arguments containing both "auth" and "token".
Detects the __DAEMONIZED=1 environment variable marker used by the vpmdhaj npm supply chain campaign (Mini Shai-Hulud) to spawn a detached credential-harvesting payload during npm install. This marker prevents re-entry when payload.bin is re-launched on subsequent require() calls. Microsoft explicitly recommends this detection, noting that the exact string __DAEMONIZED=1 has no legitimate npm ecosystem use, leading to near-zero false positives.
Page 146 of 206