Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,437
11,828
5,871
5,150
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Indicates that the user's valid credentials have been leaked.
Indicates access attempt to the PRT resource which can be used to move laterally into an organization or perform credential theft
Identifies when the Secrets are Modified or Deleted.
Transferring files with well-known filenames (sensitive files with credential data) using network shares
Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting
Detects tools extracting LSA secret DPAPI domain backup key from Domain Controllers
Detects handle requests and access operations to specific registry keys to calculate the SysKey
Anomalous Token
Sigma
Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location.
Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml
Detects potential abuse of ntdsutil to dump ntds.dit database to a suspicious location
Detects when an application acquires a certificate private key
Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs
Detect AD credential dumping using impacket secretdump HKTL
Detects when the password policy is enumerated.
Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to the client
Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN
Detects service ticket requests using RC4 encryption type
Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.
Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name located in the temp directory have been reset.
This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default).
Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.
This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default).
Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.
Detects Access to LSASS Process
This rule detects the LumarStealer infostealer malware based on specific byte patterns (YARA signatures) associated with its core functionalities. These functionalities include collecting operating system information, sending data to a command and control (C2) server, finding files of interest, and specifically identifying cryptocurrency wallets. The rule requires all these distinct patterns to be present in a file, indicating a high confidence detection of LumarStealer.
Page 205 of 206