Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,439
11,829
5,873
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
The following analytic detects a non-Chrome process accessing files in the Chrome user default folder. It leverages Windows Security Event logs, specifically event code 4663, to identify unauthorized access attempts. This activity is significant because the Chrome default folder contains sensitive user data such as login credentials, browsing history, and cookies. If confirmed malicious, this behavior could indicate an attempt to exfiltrate sensitive information, often associated with RATs, trojans, and advanced persistent threats like FIN7. Such access could lead to data theft and further compromise of the affected system.
The following analytic identifies instances where users may have mistakenly entered their passwords in the username field during authentication attempts. It detects this by analyzing failed authentication events with usernames longer than 7 characters and high Shannon entropy, followed by a successful authentication from the same source to the same destination. This activity is significant as it can indicate potential security risks, such as password exposure. If confirmed malicious, attackers could exploit this to gain unauthorized access, leading to potential data breaches or further compromise of the system.
The analytic detects unauthorized access to Outlook credentials stored in the Windows registry. It leverages Windows Security Event logs, specifically EventCode 4663, to identify access attempts to registry paths associated with Outlook profiles. This activity is significant as it may indicate attempts to steal sensitive email credentials, which could lead to unauthorized access to email accounts. If confirmed malicious, this could allow attackers to exfiltrate sensitive information, impersonate users, or execute further unauthorized actions within Outlook, posing a significant security risk.
This rule detects when processes other than Firefox or Windows Explorer attempt to access the Firefox profile directory. This directory contains sensitive user data like login credentials, browsing history, and cookies. Such activity, monitored via Windows Security Event 4663, could indicate malware (e.g., RATs, trojans) trying to harvest user information, potentially leading to data exfiltration, unauthorized account access, and system compromise.
The following analytic detects non-Chrome processes accessing the Chrome "Local State" file, which contains critical settings and information. It leverages Windows Security Event logs, specifically event code 4663, to identify this behavior. This activity is significant because threat actors can exploit this file to extract the encrypted master key used for decrypting saved passwords in Chrome. If confirmed malicious, this could lead to unauthorized access to sensitive information, posing a severe security risk. Monitoring this anomaly helps identify potential threats and safeguard browser-stored data.
This analytic detects attempts to read LSASS memory, indicative of credential dumping. It leverages Sysmon EventCode 10, filtering for specific access permissions (0x1010 and 0x1410) on the lsass.exe process. This activity is significant because it suggests an attacker is trying to extract credentials from LSASS memory, potentially leading to unauthorized access, data breaches, and compromise of sensitive information. If confirmed malicious, this could enable attackers to escalate privileges, move laterally within the network, or exfiltrate data. Extensive triage is necessary to differentiate between malicious and benign activities.
The analytic detects the creation of a remote thread in the Local Security Authority Subsystem Service (LSASS) process, identified using Sysmon EventID 8 logs. This activity is a strong indicator of credential dumping, a tactic used by adversaries to steal user authentication credentials. Successful exploitation could lead to unauthorized access to sensitive information and potential network compromise. Analysts should investigate to distinguish between legitimate tools and malicious activity.
This analytic identifies non-Chrome processes accessing the Chrome user data file "Login Data." This file is an SQLite database containing sensitive information, including saved passwords. The detection leverages Windows Security Event logs, specifically event code 4663, to monitor access attempts. This activity is significant as it may indicate attempts by threat actors to extract and decrypt stored passwords, posing a risk to user credentials. If confirmed malicious, attackers could gain unauthorized access to sensitive accounts and escalate their privileges within the environment.
The analytic identifies non-SYSTEM accounts requesting access to lsass.exe. This detection leverages Sysmon EventCode 10 logs to monitor access attempts to the Local Security Authority Subsystem Service (lsass.exe) by non-SYSTEM users. This activity is significant as it may indicate credential dumping attempts or unauthorized access to sensitive credentials. If confirmed malicious, an attacker could potentially extract credentials from memory, leading to privilege escalation or lateral movement within the network. Immediate investigation is required to determine the legitimacy of the access request and to mitigate any potential threats.
This analytic identifies processes accessing Intelliform Storage Registry keys used by Internet Explorer, excluding legitimate Internet Explorer and dllhost processes. This activity is significant because it can indicate unauthorized access or manipulation of sensitive registry keys used for storing form data in Internet Explorer, potentially leading to data exfiltration, credential theft, or further system compromise.
Detects modifications to the 'SSLKEYLOGFILE' environment variable in the Windows Registry. This variable is often used by applications like web browsers to log SSL/TLS session keys to a file, which can then be used to decrypt encrypted network traffic. Malicious actors might enable this to capture sensitive data.
Detects the execution of LaZagne, a utility used to retrieve multiple types of passwords stored on a local computer. LaZagne has been leveraged by threat actors to dump credentials.
The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by checking that it has the SeTcbPrivilege privilege set. Possible Rubeus tries to get a handle to LSA.
When two accounts from the same Entra tenant are signed into the same browser app, the device authentication (the PRT) belonging to the primary account is implicitly applied to the second account. That means the second account can inherit device-based Conditional Access, effectively bypassing intended device checks and weakening protection for privileged accounts.
Based on this behavior, I created a KQL query that detects any account assigned a privileged role signing in with private/incognito browser sessions on a device where potentially another account is already signed in โ a pattern that helps to detect the mentioned PRT/device-trust bypass. Even lower-privileged accounts are concerning when they browse in private mode so I am not filtering by just admin ones. However, to target specific roles, add:
| ๐ธ๐ฉ๐ฆ๐ณ๐ฆ ๐ต๐ฐ๐ด๐ต๐ณ๐ช๐ฏ๐จ(๐๐ด๐ด๐ช๐จ๐ฏ๐ฆ๐ฅ๐๐ฐ๐ญ๐ฆ๐ด) ๐ค๐ฐ๐ฏ๐ต๐ข๐ช๐ฏ๐ด "๐ข๐ฅ๐ฎ๐ช๐ฏ"
Based on this behavior, I created a KQL query that detects any account assigned a privileged role signing in with private/incognito browser sessions on a device where potentially another account is already signed in โ a pattern that helps to detect the mentioned PRT/device-trust bypass. Even lower-privileged accounts are concerning when they browse in private mode so I am not filtering by just admin ones. However, to target specific roles, add:
| ๐ธ๐ฉ๐ฆ๐ณ๐ฆ ๐ต๐ฐ๐ด๐ต๐ณ๐ช๐ฏ๐จ(๐๐ด๐ด๐ช๐จ๐ฏ๐ฆ๐ฅ๐๐ฐ๐ญ๐ฆ๐ด) ๐ค๐ฐ๐ฏ๐ต๐ข๐ช๐ฏ๐ด "๐ข๐ฅ๐ฎ๐ช๐ฏ"
This rule identifies risky sign-in attempts in Azure Active Directory where the sign-in originates from an IP address that has not been seen before or has been seen fewer than 3 times in the last 29 days for that specific user. It filters out guest users, non-compliant devices, and unmanaged devices, focusing on sign-ins with an aggregated risk level greater than 1 and a sign-in risk level of 50 or higher. Excluded applications are specified to reduce false positives.
Detects the creation or modification of a GitHub Actions workflow file that attempts to exfiltrate secrets. This pattern is associated with the Shai-Hulud worm, which injects malicious workflows to steal credentials using `toJSON(secrets)` and exfiltrate them using tools like `curl` and `base64`.
NetworkSignatureInspected just means the network sensor saw and matched a signature (it inspected the packet) โ it doesnโt mean the flow was blocked. Thatโs the problem.
If your machines are negotiating SMB or NTLM with unknown remote IPs, youโve got a real risk on your hands: data leakage, credential relay, or worm-style propagation. SMB to the Internet is almost never legitimate; if you donโt recognize the remote IP, treat it as suspicious.
The KQL query includes multiple conditions to detect not only default connections on legacy (139) or modern (445) SMB ports, but also cases where SMB is running over non-standard ports (attempts to evade simple port-based detection). It also extracts the SMB negotiation state so you can spot repeated or incomplete negotiation attempts (useful to detect scanning, failed auths, or relay attempts).
If your machines are negotiating SMB or NTLM with unknown remote IPs, youโve got a real risk on your hands: data leakage, credential relay, or worm-style propagation. SMB to the Internet is almost never legitimate; if you donโt recognize the remote IP, treat it as suspicious.
The KQL query includes multiple conditions to detect not only default connections on legacy (139) or modern (445) SMB ports, but also cases where SMB is running over non-standard ports (attempts to evade simple port-based detection). It also extracts the SMB negotiation state so you can spot repeated or incomplete negotiation attempts (useful to detect scanning, failed auths, or relay attempts).
Detects multiple Event ID 4648 logon attempts using the same target account but from different source accounts within a short time window. This behavior may indicate lateral movement, credential stuffing, or misuse of shared credentials. By correlating explicit credential use across users, it helps identify possible compromise or abuse of privileged accounts.
Detects a user authorizing a Salesforce application via the '/setup/connect' page. This specific TTP is associated with ShinyHunters vishing campaigns where attackers impersonate IT staff and trick employees into entering a connection code, thereby granting a malicious application access to the organization's Salesforce environment.
Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID). This could be a sign of exploitation of elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping. Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.
Detects the creation of '.library-ms' files by common archive extraction tools or Windows Explorer, which may indicate an attempt to exploit CVE-2025-24054. This vulnerability can lead to automatic outbound SMB or WebDAV authentication requests, potentially exposing NTLMv2-SSP hashes to an attacker without user interaction beyond archive extraction on unpatched systems.
Page 167 of 206