Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,439
11,829
5,873
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
See what commands are being input into the device by other people, full credentials can be in the history
Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain Controller.
Detects suspicious access to multiple Azure Storage Accounts using a Shared Access Signature (SAS) token from a single external IP address. This pattern can indicate the use of a compromised, potentially overly permissive, SAS token for reconnaissance or lateral movement.
Detects a process accessing multiple files related to known cryptocurrency wallets or browser extensions. This behavior is indicative of information stealers like LeakyStealer attempting to exfiltrate sensitive wallet data.
This rule detects attempts to exploit a known authentication bypass vulnerability in Commvault via QCommand Argument Injection. The detection specifically looks for HTTP POST requests to the '/commandcenter/api/Login' endpoint with specific content in the request body, including '_localadmin__' and 'commserver', along with a PCRE match for '-cs' preceded by a space or URL-encoded space, indicating an attempt to inject arguments.
This rule detects attempts to exploit a critical authentication bypass vulnerability (CVE-2025-54309) in CrushFTP's WebInterface. The exploit leverages an alternative channel to bypass authentication, specifically targeting the '/WebInterface/function/' URI with a 'command=login' parameter and a 'crushadmin' string in the 'as2-to' HTTP header. Successful exploitation could lead to unauthorized administrative access.
This rule detects the usage of cleartext protocols for transmitting sensitive information, such as account usernames and authentication credentials, across networks. It specifically monitors Netflow data for connections to common ports associated with unencrypted services like HTTP, FTP, Telnet, and various database/application ports. The goal is to ensure that all sensitive data and administrative access utilize encrypted channels to prevent credential access and data interception.
Detects when a user in OneLogin assumes the identity of another user account. This could indicate an attacker using compromised credentials to impersonate another user or an insider abusing privileges.
Detects when a user has potentially entered their password into the username field during a failed Okta login attempt. This can lead to the password being retained in log files, posing a security risk.
Detects suspicious process creation activities executed by the SYSTEM user, specifically looking for known malicious programs or command-line parameters often associated with credential dumping, defense evasion, and privilege escalation techniques. This includes the use of tools like Mimikatz, Rubeus, ProcDump, and various PowerShell obfuscation methods, as well as commands related to shadow copy deletion and registry hive saving.
Detects the modification of the WDigest registry key to enable plaintext credential caching. This technique is used by threat actors like the Qilin ransomware group to harvest credentials from memory using tools like Mimikatz.
Detects the execution of TruffleHog, an open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment. This activity can indicate credential harvesting by threat actors. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.
This rule detects a highly suspicious sequence of events: a user clicking on a URL (potentially a phishing link) followed by a risky sign-in attempt to Azure AD from an IP address outside the organization's defined range. The rule specifically looks for sign-ins with a high-risk level (>= 50) that occur after a URL click event, suggesting a potential compromise initiated by a phishing attack.
This rule detects suspicious service account (SPN enabled) logon attempts originating from workstation subnets. This activity can be an indicator of credential dumping techniques. The rule looks for Event ID 4768 (A Kerberos authentication ticket (TGT) was requested) where the target user name is a known SPN-enabled account and the source IP address falls within defined workstation subnets.
PFX File Creation
Sigma
Detects the creation of PFX (Personal Information Exchange) files. PFX files contain private keys and certificates, making them high-value targets for attackers. Adversaries may create these files to exfiltrate digital certificates for impersonation, establish persistent access via certificate-based authentication, or bypass security controls. Analysts should investigate the process responsible for creating the PFX file, its parent process chain, and any unusual file locations outside of standard certificate stores or development environments.
Detects an NTLM authentication attempt with an empty username field. This is a key indicator of the NTLM LDAP authentication bypass vulnerability (CVE-2025-54918), where an attacker coerces a SYSTEM account authentication and relays it to LDAP.
Detects unauthorized access to Signal Desktop's sensitive data files, specifically 'db.sqlite' which stores encrypted messages and 'config.json' which contains the decryption key. An adversary gaining access to both files can decrypt and read sensitive messages without user credentials. The rule currently focuses on the default installation path in AppData\Roaming.
This rule detects potential Pass the Hash (PtH) activity by monitoring Windows Security Event IDs 4624 (successful logon) and 4625 (failed logon) where the LogonType is 3 (Network) and the LogonProcessName is 'NtLmSsp'. It specifically filters out 'ANONYMOUS LOGON' to reduce false positives. This combination of events indicates an attempt to authenticate over the network using NTLM, which is characteristic of PtH attacks for lateral movement.
Detects potentially suspicious events involving "GetSigninToken" in AWS. An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credentials, which can help obfuscate the compromised AWS credential (the original access key) and enable pivoting from the AWS CLI to console sessions without requiring MFA, using the newly issued access key.
This rule detects when multi-factor authentication (MFA) has been explicitly disabled for a user in Azure Active Directory. This activity could indicate an adversary attempting to bypass authentication mechanisms to gain unauthorized access or maintain persistence.
Detects the possible addition of shadow credentials to an Active Directory object by monitoring for Event ID 5136 (Directory Service Changes) where the 'msDS-KeyCredentialLink' attribute is modified. This attribute is used in shadow credential attacks to establish persistence and gain unauthorized access.
Page 162 of 206