Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,437
11,828
5,871
5,150
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
This YARA rule detects the OrcusRAT backdoor by identifying specific bytecode patterns associated with its functionalities. These functionalities include retrieving TCP connections, gathering operating system information, taking screenshots, extracting passwords, and processing keylogger actions. The rule looks for a combination of these patterns within a file that also has a valid DOS header (MZ signature).
This rule detects the creation or activation of new user accounts in Okta with specific display names, such as 'svc_network_backup', which were identified as indicators of compromise during the Okta Support System 2023 breach. It aims to flag suspicious account activity that could indicate unauthorized access or persistence by an attacker. The rule can be improved by filtering out legitimate usernames if 'svc_network_backup' is a known and authorized account in the environment.
Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager, a common technique for credential access.
Detects access to the Okta password health report endpoint, which should only be accessed via the Okta Admin Console UI. This rule is intended for threat hunting to identify suspicious requests, especially when correlated with the absence of a corresponding admin console login. This activity was highlighted in the context of the Okta support incident in October 2023.
This YARA rule detects the Daolpu infostealer by identifying specific byte patterns related to its core functionalities. These functionalities include network communication, searching for sensitive files on the system, parsing Firefox configuration files, and collecting browser passwords and cookies. The rule requires all these distinct patterns to be present within a file to trigger a detection, aiming to reduce false positives.
This rule detects authentication attempts (both successful and failed) originating from a host with a 16-character alphanumeric workstation name, specifically looking for NTLM authentication. This pattern is characteristic of Metasploit's SMB modules, which often generate random 16-character workstation names during authentication attempts. The rule aims to identify potential lateral movement or reconnaissance activities using Metasploit against Windows systems.
Detects attempts to dump Active Directory credentials using Impacket's secretdump tool. This rule specifically looks for Event ID 5145 (A network share object was checked to see whether client can be granted desired access) on the ADMIN$ share, combined with access to a temporary file within the SYSTEM32 directory. This pattern is indicative of secretdump's remote activity to extract credential hashes.
Detects the creation or update of Active Directory Certificate Services (AD CS) certificate templates that are configured with risky Extended Key Usages (EKUs) and allow the enrollee to supply the subject. This combination can be exploited for privilege escalation and credential access, as described in the 'Certified Pre-Owned' whitepaper, by allowing an attacker to request certificates with arbitrary subject names, potentially impersonating privileged accounts.
Detects read access to a domain user object from a non-machine account, which can indicate user enumeration activity within Active Directory. The rule specifically looks for Event ID 4662 (An operation was performed on an object) where the ObjectType corresponds to a user object and the AccessMask includes read property permissions. It filters out activity from machine accounts and specific Microsoft Online (MSOL) accounts to reduce false positives.
This rule detects the transfer of sensitive files containing credential data over network shares. It specifically looks for filenames or paths commonly associated with credential dumping, such as 'mimidrv', 'lsass', 'windows\minidump\', 'hiberfil', 'sqldmpr', 'sam', 'ntds.dit', and 'security'. This activity often indicates an attempt to exfiltrate credentials after they have been dumped from a system.
Detects Kerberos Ticket-Granting Service (TGS) requests that utilize RC4 encryption. This is often indicative of Kerberoasting attacks, where adversaries request service tickets for Service Principal Names (SPNs) and then attempt to crack the RC4-encrypted hash offline to obtain plaintext credentials. The rule specifically excludes requests from computer accounts (service accounts ending with '$') to reduce false positives.
This rule detects the creation or update of Active Directory Certificate Services (AD CS) certificate templates that include the 'CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT' flag. This flag allows a user to specify the subject name in a certificate request, which can be abused for privilege escalation or credential access, particularly in scenarios involving misconfigured AD CS environments as described in the 'Certified Pre-Owned' research.
This rule detects Mimikatz DCSync activity by monitoring Windows Security Event ID 4662. Specifically, it looks for access attempts to replicate directory changes (identified by specific GUIDs) with an AccessMask of '0x100'. To reduce false positives, it filters out activity from 'Window Manager' and service accounts starting with 'NT AUT', 'MSOL_', or ending with '$'.
This rule detects when an Azure AD user's credentials have been identified as leaked. This detection is based on the 'leakedCredentials' risk event type reported by Azure AD Identity Protection, indicating that the user's valid credentials (e.g., username and password) have been found on the dark web or other publicly available sources.
Detects suspicious access to Microsoft Teams application's authentication tokens and local storage, which may contain sensitive credentials. This rule specifically looks for Event ID 4663 (Object Access) where the accessed object path contains '\Microsoft\Teams\Cookies' or '\Microsoft\Teams\Local Storage\leveldb', and the accessing process is NOT the legitimate 'Teams.exe'. This indicates an attempt by an unauthorized process to steal Teams authentication tokens.
This rule detects attempts to access a Primary Refresh Token (PRT) resource within Azure. A PRT is a key artifact used for single sign-on (SSO) in Azure AD, allowing users to maintain their authenticated state across various applications and services. Unauthorized access to a PRT can enable an adversary to move laterally within an organization's Azure environment, perform credential theft, and bypass multi-factor authentication (MFA) to gain access to resources as the legitimate user. This detection specifically looks for the 'attemptedPrtAccess' risk event type reported by Azure's risk detection service.
This rule detects successful password spray activity. A password spray attack involves an adversary attempting a single or small list of commonly used passwords against many different accounts to acquire valid credentials, often to avoid account lockouts. The detection specifically triggers when Azure AD Identity Protection identifies a 'passwordSpray' risk event.
Detects potential abuse of ntdsutil or similar methods to dump the ntds.dit database. This activity is often associated with credential dumping from Active Directory.
This rule identifies when secrets stored in Azure Key Vaults are modified or deleted. It specifically looks for operations such as writing, deleting, backing up, purging, updating, recovering, restoring, or setting secrets within Azure Key Vaults. This activity can indicate unauthorized access to sensitive credentials or an attempt to disrupt services by removing critical secrets.
This rule detects the usage of cleartext protocols over a network by monitoring firewall logs for allowed connections to specific destination ports commonly associated with unencrypted services. These ports include HTTP (80, 8080), FTP (21), Telnet (23), and various database or application-specific ports (e.g., 1433, 3306, 1521, 27017, 50000, 11211, 15672, 5900-5904). The rule specifically looks for 'forward' or 'accept' actions, or connections not marked as 'blocked', indicating active cleartext communication. The primary goal is to identify potential credential exposure or sensitive data transmission over insecure channels.
This rule detects potential exploitation attempts of CVE-2021-42278, also known as "noPac" or "sAMAccountName spoofing". The exploit involves an attacker creating a computer object with known credentials, then clearing its ServicePrincipalName (SPN) attribute. This manipulation grants the attacker additional permissions on the object, allowing them to make further changes. The detection logic specifically looks for Kerberos Key Distribution Center (KDC) events (EventIDs 35, 36, 37, 38) which indicate anomalies in PAC (Privilege Attribute Certificate) or ticket requests, consistent with the post-exploitation phase of CVE-2021-42278 where forged tickets are used.
Page 197 of 206