Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects the execution of a 'kubectl get secrets' command with specific parameters ('--all-namespaces', '-o json', '|| true') via a 'bash' process on Linux systems. This activity is indicative of bulk Kubernetes secret enumeration, a technique used by the TeamPCP stealer as described by Microsoft.
Detects the creation of specific log files (`ldapd*.1.gz`, `ldapd*.2.gz`) in the `/var/log/` directory. This behavior is indicative of the UNC3886 threat actor utilizing backdoored SSH clients and daemons to harvest and store XOR-encrypted credentials.
Detects a Python-initiated process attempting to read Google Cloud Platform (GCP) credentials by looking for command-line arguments containing 'GOOGLE_APPLICATION_CREDENTIALS' and 'cat 2>/dev/null'. This behavior is indicative of credential harvesting, potentially related to supply chain compromises like the Trivy incident.
This rule detects unusual modifications to Azure Arc machine identities or Role-Based Access Control (RBAC) assignments following local activity. It specifically looks for 'Write', 'Update', or 'Assign' operations on resources within the 'Microsoft.HybridCompute' resource provider where the properties include 'identity' or 'roleAssignment'. This could indicate an attempt to establish persistence or escalate privileges on hybrid machines.
Detects programmatic token refresh activity using the BAV2ROPC user agent originating from Railway IP space. This indicates automated persistent token cycling mechanisms used by the EvilTokens Phishing-as-a-Service (PhaaS) campaign to maintain access to compromised Microsoft 365 accounts.
Duo User Marked Fraud
YARA-L
This rule detects when a user marks an authentication request as fraudulent within Duo Security. This indicates a potential attempt to gain unauthorized access to a user's account, possibly through MFA fatigue or other social engineering tactics. The rule specifically looks for 'user_marked_fraud' in the security result summary of Duo authentication events.
This rule detects successful device registrations to the 'Device Registration Service' in Azure Entra. It specifically looks for sign-in events where the ResourceDisplayName is 'Device Registration Service', the ErrorCode is '0' (indicating success), and the ConditionalAccessStatus is not '1' (which typically means that conditional access did not block the authentication flow for device registration). The rule is pivotal for hunting devices registered for persistence, post-successful phishing campaign execution, where >= 1 accounts were compromised.
Detects attempts by non-Azure Arc agent processes to access '.key' files within the Azure Arc Tokens directory. This activity could indicate an attempt to exploit CVE-2026-26117 or other credential access techniques targeting Azure Arc service principal tokens.
Detects the execution of `kubectl` commands designed to dump all secrets across all namespaces within a Kubernetes cluster. This activity is indicative of an adversary attempting to gain access to sensitive credentials, as observed in supply chain compromises.
Detects the execution of `kubectl` commands designed to dump all secrets across all namespaces within a Kubernetes cluster. This activity is indicative of an adversary attempting to gain access to sensitive credentials, as observed in supply chain compromises.
This rule detects potential device code phishing attempts where a user accesses a commonly abused Platform-as-a-Service (PaaS) platform (Cloudflare Workers, Vercel, Amplify) and subsequently attempts to log in via the Microsoft device login endpoint within a 5-minute window. This sequence of events is indicative of an adversary luring a user to a malicious site hosted on a PaaS platform to capture a device code, which is then used to authenticate to Microsoft services.
Detects ShadowSniff info-stealer based on strings, PDB path, and behavioral indicators.
Detects attempts by non-Azure Arc agent processes to access '.key' files within the Azure Arc Tokens directory. This activity could indicate an attempt to exploit CVE-2026-26117 or other credential access techniques targeting Azure Arc service principal tokens.
This rule identifies events from Keeper BreachWatch indicating potential credential compromise. It specifically looks for logs categorized as 'breachwatch' and extracts details about the breach, including compromised domains and risk severity, along with the affected username and remote IP address.
This analytic query detects potential phishing compromise activity by correlating URL click events from Defender for Office 365 with Sign-in device code authentication logs.
Detects PowerShell script block logging events (Event Code 4104) that indicate the instantiation of the Outlook COM object via the MAPI namespace. This behavior is associated with malware like Horabot for email harvesting and spreading.
Detects when a single user account successfully signs in from two or more distinct IP addresses within a short timeframe. This can be an indicator of an adversary-in-the-middle (AiTM) attack where both the legitimate user and the attacker have active, authenticated sessions from different locations.
Detects command line executions from non-standard applications attempting to query the local Azure Arc metadata endpoints (ports 40341/40342), which may indicate an attacker enumerating or exploiting the HIMDS token service (CVE-2026-26117).
This rule detects suspicious activity involving the WebDAV client, specifically looking for scenarios where WebDAV connections to public IPs are initiated from a process that has recently modified the RunMRU registry key to include WebDAV parameters and executables like 'cmd' or 'net use', and has also accessed clipboard data. This combination of behaviors suggests potential credential theft or lateral movement attempts using WebDAV.
This rule detects when two different MSI installations, both related to known VPN clients (Pulse Secure, Fortinet, Ivanti, GlobalProtect), occur on the same device within a short timeframe. This could indicate an attempt to establish redundant access, bypass security controls, or an unusual administrative activity.
Detects the use of the klist utility via cmd.exe to enumerate active authentication credentials (Kerberos tickets) on a host. This discovery step is consistently used by threat actors, such as LeakNet, to map out accessible credentials before attempting lateral movement with tools like PsExec.
Page 153 of 206