Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,439
11,829
5,873
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
This analytic detects the extraction of authentication certificates using Windows Event Log - CAPI2 (CryptoAPI 2). It specifically leverages EventID 70, which is generated when a certificate's private key is acquired. This detection is significant because it can identify potential misuse of certificates, such as those extracted by tools like Mimikatz or Cobalt Strike. If confirmed malicious, this activity could allow attackers to impersonate users, escalate privileges, or access sensitive information, posing a severe risk to the organization's security.
This analytic detects suspicious loading of the `vaultcli.dll` module by processes executing from publicly writable Windows directories. `vaultcli.dll` is known to be abused by information stealers, such as Meduza, to extract credentials from the Windows Credential Vault. The rule monitors for `ImageLoaded` events (Sysmon EventID 7) where `vaultcli.dll` is loaded by a process whose path is within common temporary, public, or other writable system directories. This behavior indicates potential credential theft attempts by malicious software.
Detects attempts to harvest credentials by enabling the RemoteRegistry service or dumping the SAM, SECURITY, or SYSTEM registry hives, which are behaviors associated with the Flax Typhoon APT group.
Detects the installation of browser extensions, primarily cryptocurrency wallets, that are known targets for the Stealit information stealer.
Detects access to sensitive browser files by non-browser processes. This can indicate attempts by malware to steal credentials, cookies or other sensitive user data.
This rule detects potential device code phishing attempts by correlating URL click events with sign-in logs using the 'deviceCode' authentication protocol. It specifically looks for successful or failed sign-ins (result types 0, 50074, 50076, 500121) that occur after a user clicks on a URL.
The analytic detects a process loading the `credui.dll` or `wincredui.dll` module. This detection leverages Sysmon EventCode 7 to identify instances where these DLLs are loaded by processes outside typical system directories. This activity is significant because adversaries often abuse these modules to create fake credential prompts or dump credentials, posing a risk of credential theft. If confirmed malicious, this activity could allow attackers to harvest user credentials, leading to unauthorized access and potential lateral movement within the network.
Detects potential DC Sync attacks, where an adversary mimics a domain controller to request credential data using replication permissions. This rule identifies Event ID 4662 with AccessMask 0x100 and specific replication-related properties, excluding known benign accounts.
Detects potential Multi-Factor Authentication (MFA) fatigue attacks by identifying a high number of MFA denial events for a single user within a short timeframe. This rule specifically looks for sign-in logs where the user explicitly declined the authentication prompt, indicating a possible attempt by an attacker to bombard the user with MFA requests until they approve one.
The following analytic detects processes on macOS systems that are tapping keyboard events, potentially monitoring all keystrokes made by a user. It leverages data from osquery results within the Alerts data model, focusing on specific process names and command lines. This activity is significant as it is a common technique used by Remote Access Trojans (RATs) to log keystrokes, posing a serious security risk. If confirmed malicious, this could lead to unauthorized access to sensitive information, including passwords and personal data, compromising the integrity and confidentiality of the system.
This rule detects suspicious sign-in attempts to Microsoft services (login.microsoftonline.com, graph.microsoft.com, outlook.office365.com) that occur within 30 minutes of a user clicking on a URL associated with these services. The sign-in is considered suspicious if it originates from a user agent commonly used by automated tools (e.g., axios, curl, python-requests, httpclient, Go-http-client) and is flagged with a 'atRisk' or 'high' risk level by Azure AD. This combination suggests a potential credential compromise following a phishing attempt, where an attacker might be using automated tools to leverage stolen credentials.
Detects a potential 'UnPAC the Hash' Kerberos attack, a technique used by Akira ransomware. The attack involves requesting an Active Directory certificate and then using it for a User-to-User (U2U) Kerberos authentication with PKINIT to extract NTLM hashes.
This rule detects potential persistence mechanisms related to browser extensions. It looks for processes launching Chrome or Edge with the '--load-extension' command-line argument, which can be used to load unpacked extensions. Additionally, it monitors registry modifications to 'ExtensionInstallForcelist' that contain 'http' or 'crx', indicating a forced installation of an extension, potentially from a remote source or a local file.
Detects potential unauthorized browser extension installations or debugging activities by monitoring process and network events related to popular web browsers.
The analytic detects a process enabling the "SeDebugPrivilege" privilege token, leveraging Windows Security Event Logs with EventCode 4703. This privilege allows a process to inspect and modify the memory of other processes, which can lead to credential dumping or code injection. The rule filters out common legitimate processes to reduce false positives. If confirmed malicious, an attacker could gain extensive control over system processes, enabling privilege escalation, persistence, or access to sensitive information.
Detects when a web browser (Chrome, Edge, Firefox, Brave, Opera) initiates a process that is not another instance of itself. This could indicate a drive-by download, execution of malicious code, or other suspicious activity originating from a browser.
This rule detects instances where a user clicks on a URL identified as potentially malicious (phishing-related) and subsequently has a risky sign-in event in Azure AD. The rule correlates URL click events from email with Azure AD sign-in logs, specifically looking for sign-ins marked as risky or originating from suspicious user agents (e.g., specific axios versions). The phishing URLs are identified by keywords such as 'azureapplicationregistration.pages.dev', 'chrnobinson.com', 'workers.dev', '.pages.dev', '.web.core.windows.net', '/oauth2/v2.0/authorize', 'client_id=', and 'scope=openid'.
Detects attempts to read the memory of browser processes (Chrome, Edge, Firefox, Brave, Opera). This activity can be indicative of credential dumping or other forms of data exfiltration from web browsers.
The analytic detects attempts to dump the LSASS process memory, a common technique in credential dumping attacks. It leverages Sysmon logs, specifically EventCode 10, to identify suspicious call traces to dbgcore.dll and dbghelp.dll associated with lsass.exe. This activity is significant as it often precedes the theft of sensitive login credentials, posing a high risk of unauthorized access to systems and data. If confirmed malicious, attackers could gain access to critical credentials, enabling further compromise and lateral movement within the network.
Detects HTTP responses containing JavaScript associated with ClickFix phishing kits. These kits manipulate the DOM to mimic browser verification pages and trick users into copying and executing malicious commands.
Detects .NET DLLs containing hardcoded Azure Storage Account credentials, such as access keys or SAS tokens. This technique was observed in the Axis Communications plugin for Autodesk Revit, where it could have enabled a supply chain attack.
Page 166 of 206