Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,432
11,818
5,871
5,150
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Flags service principal sign-ins by the ConnectWise/SkyKick app IDs from a public address or a Python/curl client. Per Huntress, the vendor apps normally egress from Azure private IPv6 (fd...) and call Graph with the kiota-dotnet SDK. Both conditions together are the strongest signal. This survives IP rotation. Baseline your tenant first, since a legitimate public egress would show here.
Detects potential data exfiltration and credential hunting where an endpoint downloads a database backup using presigned URLs or cloud storage signatures within 6 hours of searching local files for API keys or private keys.
Detects Chromium-based browsers launched with remote debugging port 9222 or execution of chrome-decryptor tooling by Python processes, indicative of credential theft or Chrome CDP cookie extraction (such as Armorsteal).
Detects a suspicious behavioral sequence in AWS CloudTrail logs from external IPs using the Boto3 user agent. The sequence starts with caller-identity validation (GetCallerIdentity), followed by a high volume of secret reads (Secrets Manager) or cloud storage object reads (S3), indicating automated reconnaissance, credential theft, or data exfiltration.
Detects a potential password spraying attack characterized by multiple authentication failures across numerous users from a single IP address, followed by a successful sign-in from that same IP, culminating in a privileged role or credential change performed by the compromised account.
Detects password spraying activity against Azure Active Directory / Microsoft 365 services where a single source IP attempts to authenticate against numerous distinct user accounts with low attempt counts per account and sustained over time, while excluding successful authentication IPs.
Detects NTDSUtil commands associated with Active Directory database export, installation media preparation, and snapshot creation, which may facilitate offline credential extraction.
Detects indicators of ToolShell web shell creation (spinstall0.aspx) and ASP.NET machine key harvesting activities (reading web.config or accessing validationkey/decryptionkey materials via w3wp child processes or file access audits) on SharePoint servers.
Detects potential mimikatz-like tools accessing LSASS from non system account
Detects the correlation between the loading of known stealer plugin DLLs outside of standard application paths and subsequent process activity accessing credential stores, sensitive files, or executing wireless key recovery commands.
Detects AI coding assistants and agents (such as Copilot, Cursor, Claude Code, etc.) spawning command-line interpreters (PowerShell, CMD, Node, Bun, Deno) with potential API keys, tokens, or credentials exposed in the process command line.
Detects the creation of application-specific passwords followed by their initial use from unknown or new IP addresses using legacy authentication clients, which may indicate account compromise or persistence establishment.
Detects unauthorized access to virtual hard disk (VMDK) files by non-standard processes followed by the creation or modification of sensitive offline credential artifacts such as ntds.dit or SYSTEM hives on the same host within a 2-hour window, indicating potential offline credential theft.
Detects a high volume of Azure Key Vault secret reads or key decryption operations performed by a single caller identity from multiple source IP addresses within a one-hour window, which may indicate credential harvesting or unauthorized access.
Detects new client secrets or certificates added to any service principal in Azure AD, specifically identifying activities linked to the ConnectWise supply-chain attack or suspicious user agents.
Detects Python interpreter activity accessing multiple credential store categories (such as password managers, Discord, SSH keys, or Steam) in a short window on a single device, or specific stealer scripts associated with known file paths.
Detects OAuth credential activity on GitHub. Tokens bypass password and multi-factor
controls and persist until revoked, making them the standard persistence mechanism
on the platform. A token created on a compromised account continues to work long
after the password is reset.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=iam where sourcename='GITHUB' and action='CONFIGURATION_CHANGED'
| groupby target, role, accesstype, operationtype, authtokenhash
controls and persist until revoked, making them the standard persistence mechanism
on the platform. A token created on a compromised account continues to work long
after the password is reset.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=iam where sourcename='GITHUB' and action='CONFIGURATION_CHANGED'
| groupby target, role, accesstype, operationtype, authtokenhash
Detects endpoint execution of specific known brute-force scripts and tools (such as ssh_brute.py, brute3.py, auto_login.py, etc.) using Python or shell interpreters, correlated with a high outbound network connection fan-out (50 or more distinct target IPs) from the same process.
Detects process handle on LSASS process with certain access mask
Detects processes accessing or enumerating multiple cryptocurrency wallet files or directories across common storage paths (e.g., Exodus, Electrum, Coinomi, Ethereum, Atomic, Guarda) within a short timeframe, which is often indicative of wallet theft or credential harvesting malware.
M365 Malicious Mailbox Rule Abuse
Cortex XDR
Detects the creation or modification of Microsoft 365 Exchange inbox rules that exhibit characteristics of malicious behavior, such as using trivial or blank names, moving items to rarely-monitored folders (e.g., 'Conversation History', 'RSS Feeds'), or containing keywords related to phishing, credential harvesting, or financial fraud.
Page 2 of 206