Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,438
11,829
5,872
5,150
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Query #1: Look for public IP addresses that failed to logon to a computer multiple times, using multiple accounts, and eventually succeeded.
This query was originally published in the threat analytics report, Qakbot blight lingers, seeds ransomware
Qakbot is malware that steals login credentials from banking and financial services. It has been deployed against small businesses as well as major corporations. Some outbreaks have involved targeted ransomware campaigns that use a similar set of techniques. Links to related queries are listed under See also.
The following query detects attempts to access files in the local path that contain Outlook emails.
Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
Qakbot is malware that steals login credentials from banking and financial services. It has been deployed against small businesses as well as major corporations. Some outbreaks have involved targeted ransomware campaigns that use a similar set of techniques. Links to related queries are listed under See also.
The following query detects attempts to access files in the local path that contain Outlook emails.
Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
Detects suspicious process access to the Local Security Authority Subsystem Service (LSASS) memory. The rule specifically looks for processes attempting to access LSASS with certain access flags from potentially suspicious folders like temporary directories or user application data folders. This behavior is indicative of credential dumping attempts, often performed by malware or attackers to harvest credentials.
This YARA rule detects the Skuld infostealer by identifying specific byte patterns associated with its functionalities. These functionalities include retrieving the MAC address of the infected system, enumerating files (likely for data collection), taking screenshots, and specifically targeting Discord backup codes. The rule looks for a combination of these distinct code patterns within a PE file (indicated by the MZ header).
This rule detects the presence of keywords related to LSASS (Local Security Authority Subsystem Service) memory dumping in process command lines. Adversaries often dump LSASS memory to extract credentials such as plaintext passwords, NTLM hashes, and Kerberos tickets. The rule specifically looks for combinations of "lsass" with dump file extensions like ".dmp", ".zip", ".rar", or other common dump-related keywords like "lsassdump", "lsassdmp", "nanodump", and "sqldmpr". This activity is a strong indicator of an attempt to steal credentials from the system.
This rule detects the creation of files with specific names or patterns commonly used by memory dumping tools to extract credentials from the Local Security Authority Subsystem Service (LSASS) process memory. The rule looks for file creation events where the file path contains keywords like 'lsass', 'nanodump', 'sqldmpr', or specific filenames such as 'Andrew.dmp', 'Coredump.dmp', 'lsass.dmp', 'lsass.rar', 'lsass.zip', 'NotLSASS.zip', 'PPLBlade.dmp', and 'rustive.dmp'. This activity is indicative of an attempt to dump LSASS memory, which contains sensitive user credentials.
This rule detects the execution of `createdump.exe`, a legitimate utility, when it is used to dump process memory. The detection is based on the presence of specific command-line arguments such as '-u', '--full', '-f', '--name', or '.dmp', which are indicative of memory dumping operations. This activity is often associated with attempts to extract credentials or other sensitive information from running processes.
Detects process access requests to the LSASS process with specific call trace calls and access masks. This behavior is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature.
Detects the creation of an lsass.dmp file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager, which is a common technique for credential access.
SharpSuccessor is a .NET-based post-exploitation tool designed to weaponize the BadSuccessor attack. This rule detects the execution of SharpSuccessor.exe or command-line arguments containing 'SharpSuccessor' in process launch events or specific Windows Security Auditing events (EventCode 4673) indicating a privileged service call. This activity is indicative of privilege escalation attempts in Active Directory environments, specifically leveraging 'CreateChild' permissions over Organizational Units (OUs) to escalate privileges to Domain Administrator.
Detects the use of the Microsoft Windows Resource Leak Diagnostic tool rdrleakdiag.exe to dump process memory. This tool can be abused by adversaries to extract sensitive information, such as credentials, from process memory.
The following analytic identifies user sessions in Office 365 accessed from multiple IP addresses, indicating potential adversary-in-the-middle (AiTM) phishing attacks. It detects this activity by analyzing Azure Active Directory logs for 'UserLoggedIn' operations and flags sessions with more than one associated IP address. This behavior is significant as it suggests unauthorized concurrent access, which is uncommon in normal usage. If confirmed malicious, the impact could include data theft, account takeover, and the launching of internal phishing campaigns, posing severe risks to organizational security.
Detects attempts to enumerate Kubernetes secrets, which could indicate an adversary is searching for sensitive information like API keys, tokens, or other credentials stored within the cluster.
This rule detects suspicious Kerberos Ticket Granting Ticket (TGT) requests, specifically looking for events where a computer account (indicated by a '$' at the end of the `TargetUserName`) requests a TGT with a certificate thumbprint present. This behavior is often observed after an attacker has obtained a computer certificate, potentially through techniques like PetitPotam, and is attempting to leverage it to request Kerberos tickets using tools like Rubeus. The rule focuses on Windows Event ID 4768, which signifies a Kerberos authentication service ticket request. It filters out requests from the local host (::1) and those without a certificate thumbprint.
This rule detects repeated authentication failures from a single hostname targeting multiple distinct user accounts within a 30-minute window. This behavior is indicative of a password spraying attack, where an adversary attempts to use a small set of common passwords against many accounts to avoid account lockouts on a single account.
This rule detects a sequence of multiple failed login attempts (more than 4) followed by a successful login for the same user on the same hostname within a 15-minute window. It specifically targets Windows login events (event IDs 4625 for failure and 4624 for success) and correlates them with user and asset entity data, focusing on users in the 'Domain Admins' group and assets that are 'Domain Controllers'. This pattern is indicative of a brute-force attack or password guessing attempt that eventually succeeded.
Detects the creation of temporary files with specific naming conventions (8 alphanumeric characters followed by '.tmp') in the 'C:\Windows\System32\' directory, when the creating process is 'svchost.exe'. This pattern is indicative of remote credential dumping activity often associated with tools like CrackMapExec and Impacket-secretsdump, which use svchost.exe to write temporary files containing dumped credentials.
This rule detects a pattern of multiple failed login attempts followed by a successful login for the same user on the same hostname within a 15-minute window. This behavior is indicative of a brute-force attack or password guessing attempt that eventually succeeded.
This rule identifies rare subscription-level operations in Azure, specifically focusing on actions that involve listing keys for various Azure resources (DocumentDB, Maps, Media, Cognitive Services, Storage) or writing snapshots and network security groups. It aims to detect when these sensitive operations are performed from a previously unseen source IP address, indicating potential unauthorized access or credential compromise.
This rule detects attempts to access the Active Directory contact object to read the AD FS Distributed Key Manager (DKM) master key value. This activity is identified by monitoring Windows Security Event ID 4662 (An operation was performed on an object) for specific property GUIDs associated with the DKM master key, combined with a successful user login event (Event ID 4624) from the same host within a 5-minute window. This indicates a potential attempt to compromise AD FS for credential theft or persistence.
This rule detects suspicious command-line activity indicative of credential access or reconnaissance, as outlined in a CISA 'Living off the Land' report. Specifically, it looks for commands that attempt to list SSH known hosts, access Firefox profiles, execute Mimikatz, query OpenSSH or RealVNC registry keys, or save SAM/SYSTEM registry hives. While individual commands might be benign, their combined presence or repeated execution could signal malicious intent.
Page 182 of 206