Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,439
11,829
5,873
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects successful authentication attempts originating from clients using legacy authentication methods, identifiable via specific user agent strings. This activity can indicate an adversary attempting to bypass multi-factor authentication (MFA), potentially as part of a password spray attack. Legacy authentication protocols often do not support modern MFA mechanisms, making them a target for attackers who have obtained valid credentials through other means or are performing brute-force attacks like password spraying.
Detects the use of TruffleHog for AWS credential validation by identifying GetCallerIdentity API calls where the userAgent indicates TruffleHog. Threat actors leverage TruffleHog to enumerate and validate exposed AWS keys. Successful exploitation allows threat actors to confirm the validity of compromised AWS credentials, facilitating further unauthorized access and actions within the AWS environment.
Detects the execution of TruffleHog, a tool designed to search for secrets across various platforms such as Git, Jira, Slack, and SharePoint. While TruffleHog is a legitimate tool often used in CI pipelines and security assessments, its execution can also indicate malicious activity, as observed in campaigns like Shai-Hulud targeting npm packages to steal sensitive information. The rule triggers on the execution of 'trufflehog.exe' or when its command line arguments indicate searching specific platforms or verifying results.
This rule detects attempts to abuse Azure Browser Single Sign-On (SSO) by monitoring for the loading of the 'MicrosoftAccountTokenProvider.dll' library. This DLL is involved in requesting OAuth 2.0 refresh tokens for Azure AD-authenticated Windows users on Azure AD-joined machines, enabling SSO in browsers. An attacker could leverage this to authenticate to Azure AD as the compromised user within a browser. The rule filters out legitimate loads by common processes like BackgroundTaskHost.exe, Visual Studio (devenv.exe), Internet Explorer (iexplore.exe), Microsoft Edge (msedge.exe, msedgewebview2.exe), and OneDrive (OneDrive.exe) to reduce false positives.
This rule detects activities performed by the AWS root account. The root account has unrestricted access to all resources in an AWS account, making its usage a critical security event that often indicates a potential compromise, misconfiguration, or a highly privileged operation that should be closely monitored. The rule specifically looks for events where the 'userIdentity.type' is 'Root' and excludes 'AwsServiceEvent' to filter out automated AWS service activities that might legitimately use root permissions internally.
This rule detects PowerShell scripts attempting to perform keylogging. It specifically looks for the string 'Get-Keystrokes' which is often associated with keylogging scripts, or a combination of 'Get-ProcAddress user32.dll GetAsyncKeyState' and 'Get-ProcAddress user32.dll GetForegroundWindow' which are API calls commonly used in PowerShell keyloggers to capture keyboard input and determine the active window.
This rule detects the execution of TruffleHog, a tool designed to find secrets in various platforms such as Git, GitHub, Jira, Slack, Confluence, SharePoint, Docker images, and cloud storage services like S3 and GCS. While TruffleHog is a legitimate tool often used in CI pipelines and security assessments, its execution can also indicate malicious activity, as observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information. The rule triggers on either the image name ending with '/trufflehog' or a combination of command-line arguments indicating its use to scan specific platforms and the '--results=verified' flag.
This rule detects attempts to read or retrieve BitLocker recovery keys from Azure audit logs. This activity can be indicative of an attacker attempting to gain access to encrypted data on compromised devices or to bypass disk encryption for persistence or defense evasion.
Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blob matching a pattern indicative of a marshaled CREDENTIAL_TARGET_INFORMATION structure. This pattern is commonly used in Kerberos coercion attacks where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests, such as in CVE-2025-33073. Investigation should focus on the user account making the changes, as it is likely a compromised low-privileged account.
This rule detects the use of legacy authentication protocols for sign-ins to Azure AD. Legacy authentication protocols (such as POP3, IMAP, SMTP, MAPI, Exchange ActiveSync, Exchange Web Services, and 'Other client') do not support modern security features like Multi-Factor Authentication (MFA) and are often targeted by attackers for credential stuffing, brute-force attacks, and other credential-based attacks. Detecting and alerting on these sign-ins helps identify potential compromise or policy violations.
Detects the renaming of an existing computer account to an account name that doesn't contain a '$' symbol, which is a key indicator of the CVE-2021-42287 (SamAccountName Spoofing) attack. This technique is often used to impersonate a Domain Controller.
This rule identifies suspicious usage of the AWS Security Token Service (STS) `AssumeRole` API call. Specifically, it looks for instances where the `userIdentity.type` is `AssumedRole` and the `userIdentity.sessionContext.sessionIssuer.type` is `Role`. This pattern indicates that an AWS role is being assumed by another role, which could be a legitimate administrative action but also a technique used by attackers for lateral movement and privilege escalation within an AWS environment. Attackers might use `AssumeRole` to switch to roles with higher privileges or to move between different accounts or services after gaining initial access.
Detects when a temporary access pass (TAP) is added to an account in Azure AD. TAPs are a passwordless authentication method that can be used for onboarding, recovery, or as a strong credential. The addition of a TAP, especially to privileged accounts, should be investigated as it could indicate an attempt to gain or maintain unauthorized access.
Detects usage of the Windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack referred to as PetitPotam. The usage of this RPC function should be rare if ever used at all. Thus, any usage of this function is uncommon enough that it should warrant further investigation to determine if it is legitimate. View surrounding logs (within a few minutes before and after) from the Source IP to determine if it is legitimate. Logs from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc.
This rule detects attempts to enable auditing of TTY input on Linux systems by monitoring modifications to PAM (Pluggable Authentication Modules) configuration files. Specifically, it looks for changes to '/etc/pam.d/system-auth' and '/etc/pam.d/password-auth' in conjunction with TTY-related audit events. This activity could indicate an adversary attempting to implement keylogging functionality using the pam_tty_audit module to capture user input.
Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.
Detects DNS queries for domains associated with the Tykit phishing kit infrastructure. These domains are used for hosting phishing pages and for C2 exfiltration.
Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account. This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.
This rule identifies a critical security misconfiguration or bypass scenario within Azure Privileged Identity Management (PIM) where a privileged role can be activated without requiring multi-factor authentication (MFA). This can significantly increase the risk of unauthorized access and privilege escalation if an attacker compromises credentials for an account with PIM roles.
This rule detects the execution of various hack tools and scripts commonly used for SMB relay attacks and privilege escalation on Windows systems. It specifically looks for process creations or command-line arguments associated with tools like PetitPotam, RottenPotato, HotPotato, JuicyPotato, Responder, ntlmrelayx, and smbrelayx, as well as PowerShell scripts like Invoke-Tater and Invoke-PetitPotam. The rule aims to identify attempts to exploit NTLM relay vulnerabilities to gain elevated privileges or access credentials.
Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. This activity could lead to initial access, persistence, or privilege escalation, potentially compromising sensitive data and operations.
Page 163 of 206