Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,427
11,813
5,871
5,145
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Identifies node.js or npm processes attempting to access known credential stores or execute credential dumping utilities, which may indicate the presence of the Miasma credential-stealing worm.
This rule detects the use of Azure Managed Identity tokens originating from non-Azure IP spaces. This scenario is indicative of token theft, likely via the Instance Metadata Service (IMDS) endpoint (169.254.169.254), followed by an external replay of the stolen token from an attacker's infrastructure. Legitimate Managed Identity calls are expected to originate from Azure infrastructure IPs. The rule filters out legitimate Microsoft/Azure ASNs and RFC1918 private IP ranges to reduce false positives. It also categorizes the potential attack stage based on the operation name, including Key Vault access, Storage access, VM Code Execution, Privilege Escalation, and Directory Enumeration.
Detects the execution of rundll32.exe calling a specific exported function ('open') associated with the fake lock screen DLL ('com6848.dll') to capture user passwords. This technique is often used in credential harvesting campaigns.
Detects Node.js or Bun processes accessing sensitive developer configuration directories such as .ssh and .npmrc, indicating potential credential harvesting. This rule specifically looks for file access or open events initiated by 'node.exe', 'node', 'bun.exe', or 'bun' processes targeting paths containing '.ssh' or '.npmrc', or files named '.npmrc'.
Identifies the execution of DumpIt, a memory acquisition tool often abused by attackers to dump LSASS and extract NTLM hashes or Kerberos tickets.
Docker Run/Exec Guardrails Bypass
Cortex XDR
This rule detects the execution of a Docker command with the '--privileged' flag on a Linux system, combined with the execution of specific system information gathering commands. This combination is often indicative of an attempt to escape a container or gain elevated privileges within a containerized environment, potentially leading to host compromise. The '--privileged' flag grants a container nearly all capabilities of the host machine, making it a critical security concern when used maliciously.
Kali365 PHaaS Device Code Detection
Cortex XDR
This rule detects potential device code phishing attempts by correlating a device code flow initiated from an unmanaged/non-compliant device with a suspicious user agent (e.g., 'python-requests' or '-live') and an 'unbound' signInTokenProtectionStatus, with a subsequent 'Cmsi:Cmsi' token replay event for the same user. This combination suggests a successful device code phishing attack where an adversary has obtained and is replaying a token after the victim has authenticated.
Detects the execution of rundll32.exe calling a specific exported function ('open') associated with the fake lock screen DLL ('com6848.dll') to capture user passwords. This technique is often used in credential harvesting campaigns.
This rule detects authentication attempts to Microsoft 365 Azure AD from a list of known malicious IP addresses and CIDR ranges associated with the EvilToken phishing campaign. It specifically filters for 'Cmsi:Cmsi' request types, which are indicative of session replay signals used in device code phishing.
Detects possible MFA-approved session replay by identifying abnormal reuse of authenticated sessions across multiple IPs, browsers, and devices compared against a 14-day historical baseline. The rule prioritizes browser/device anomalies over geography since modern attackers often use same-country VPS/proxies.
Node.js Accessing Developer Secrets
Cortex XDR
Detects Node.js processes rapidly reading multiple sensitive developer configuration or credential files (e.g., .env, AWS credentials, SSH keys) within a short timeframe. This behavior is indicative of infostealer activity, often observed with malicious npm packages.
Detects anomalous Microsoft Entra ID sign-in events where the application accessed is the Microsoft Authentication Broker (AppId 29d9ed98-a469-4536-ade2-f981bc1d605e) and the User-Agent indicates a Node.js automated backend ('node' or 'undici'). This combination strongly suggests Tycoon2FA operator polling for device-code token acquisition.
SharePoint Online Sensitive Data Search
Cortex XDR
This rule detects when users perform search queries in SharePoint Online that contain keywords indicative of sensitive data. The rule categorizes these searches into several types: credentials, personnel/HR information, infrastructure reconnaissance, financial/PII, and confidential business information.
Detects network connections or DNS queries to known lookalike domains utilized by UNC6671 (BlackFile) for adversary-in-the-middle (AiTM) credential harvesting and real-time MFA bypass during vishing operations.
Tycoon2FA Known Infrastructure Detection
Cortex XDR
This rule detects suspicious sign-in attempts to Microsoft 365 accounts that originate from known Tycoon2FA infrastructure. It specifically looks for device code flow authentications from IP addresses and Autonomous System Numbers (ASNs) associated with Tycoon2FA, combined with indicators like unmanaged/non-compliant devices, specific user agent patterns (axios, node, undici), and particular application IDs, and an unbound sign-in token protection status. This combination of indicators suggests an attempt to hijack Microsoft 365 accounts using device code phishing.
Detects abnormal MFA session behavior by monitoring user sessions with multiple IPs or browsers over 24h. Note: KQL 14-day historical baseline and set_difference logic is approximated.
Tycoon2FA PHaaS User Agent Detection
Cortex XDR
Detects user agents associated with Tycoon2FA phishing-as-a-service (PHaaS) campaigns, specifically targeting Microsoft 365 accounts via device code phishing. The rule identifies user agents like 'axios/1.13.x' (credential relay variant) and 'node' or 'undici' (device code variant) in Azure AD sign-in logs where the original transfer method is 'deviceCodeFlow', and the device is neither managed nor compliant, and the sign-in token protection status is unbound.
Smartcard Disabled Event Detected
Cortex XDR
This rule detects when a smartcard is disabled, indicated by a specific change code (2060) in Windows raw event data. Disabling smartcards can be a tactic used by adversaries to bypass multi-factor authentication or other security controls.
Tycoon2FA Kit URL Parameters
Cortex XDR
Identifies network traffic containing the distinct 'bltpg' and 'sid' parameters used by the Tycoon2FA credential harvesting platform. This rule specifically looks for HTTP network data containing both 'bltpg=' and 'sid=' within the action_network_http field, which are indicative of the Tycoon2FA phishing kit's communication patterns. The rule then deduplicates alerts based on agent hostname and remote IP to reduce alert volume.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects possible Adversary-in-the-Middle (AiTM) attacks, session cookie replay, MFA session hijacking, token theft, and stolen cloud session reuse by identifying abnormal SessionId reuse across multiple IPs, browsers, and devices. This detection compares current session activity against a 14-day historical user behavior baseline to identify new or abnormal behavior. It includes risk scoring and account classification, while reducing false positives from token refresh activity and common Microsoft Teams noise.
Page 148 of 206