Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,437
11,828
5,871
5,150
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects a multi-stage attack chain originating with a healthcare-themed phishing email (e.g., billing or patient coordination lures) that leads to a link click, followed by a subsequent suspicious user sign-in from a non-managed/non-compliant device for the same recipient. This correlates email threat data, URL click telemetry, and sign-in logs to identify potential credential harvesting.
Detects a multi-stage attack chain originating with a healthcare-themed phishing email (e.g., billing or patient coordination lures) that leads to a link click, followed by a subsequent suspicious user sign-in from a non-managed/non-compliant device for the same recipient. This correlates email threat data, URL click telemetry, and sign-in logs to identify potential credential harvesting.
Detects anomalous credential access behavior by identifying instances where a compromised explorer.exe process (injected with the Kothamine payload DLL MicrosoftEdgeUpdateCore.dll) accesses browser cookie stores and gaming credential files in quick succession.
Sequence detection for the three-step chain — credential reset, MFA/authenticator reset, new device registration — completing within 40 minutes for one user, directly modeling the Scattered Spider/UNC3944 speed-to-domain-admin playbook from Mandiant M-Trends 2026.
Detects a suspicious pattern where an inbound Microsoft Teams call or chat from an untrusted external guest tenant is followed within 30 minutes by a credential, MFA, or account-recovery action on the target user's account in Entra ID. This behavior is indicative of a vishing-over-Teams attack where an adversary impersonates IT support to facilitate unauthorized account recovery or MFA bypass.
Detects directory replication requests (Event ID 4662) using DS-Replication-Get-Changes or DS-Replication-Get-Changes-All GUIDs initiated by a computer account that is not a recognized domain controller. This behavior is indicative of a DCSync attack, where an adversary attempts to pull sensitive credential data directly from Active Directory.
Detects anomalous Kerberos ticket requests that are characteristic of Golden Ticket attacks. The rule flags the use of weak encryption types (e.g., RC4) commonly used in forged tickets even in AES-enforced environments, and direct requests for the KRBTGT service account outside of legitimate ticket renewal operations.
This rule detects potential AS-REP Roasting activity by monitoring Windows Event ID 4768 (TGT Request). It identifies multiple Kerberos AS-REQ requests from a single IP address within a 10-minute window, where the PreAuthType is 0 (indicating no pre-authentication) and the encryption type is RC4 (0x17 or 23). This behavior is characteristic of enumeration and exploitation tools such as Rubeus or Impacket's GetNPUsers.py, which attempt to obtain extractable TGTs for accounts that do not require Kerberos pre-authentication.
This rule detects potential credential dumping from the Local Security Authority Subsystem Service (LSASS) memory. It identifies two common techniques: 1) The use of the Windows 'comsvcs.dll' library exported via 'rundll32.exe' to initiate a minidump of the LSASS process, and 2) Unauthorized processes opening handles to LSASS with specific access rights (0x1010, 0x1410) often associated with memory reading for dumping purposes.
Detects potential password spraying activity by identifying high-volume failed authentication attempts (ResultType 50126 or 50053) against multiple accounts from a single source IP, followed by a successful authentication from the same IP. This pattern indicates an adversary who has identified one or more valid credentials after an initial spraying campaign.
Detects multiple Kerberos AS-REQ (Event ID 4768) requests initiated for distinct user accounts from a single source IP within a short timeframe (10 minutes) where Kerberos pre-authentication was not used (Pre-Authentication Type 0). This pattern is a key indicator of AS-REP roasting activity, often performed by tools like Rubeus or Impacket's GetNPUsers.py to harvest user TGTs for offline cracking.
Detects instances where an AI agent tool invocation contains potential credential data (API keys, tokens) followed by a suspicious sign-in or Key Vault access event from an atypical location for that specific identity within a short timeframe. This rule monitors for potential exfiltration or abuse of credentials handled or exposed by AI agents.
Detects suspicious mobile-device HTTP traffic patterns indicative of 'quishing' (QR code phishing). The rule identifies mobile HTTP GET requests (iPhone, Android, Mobile Safari, iPad) that lack a Referer header, followed by HTTP POST requests to common credential entry URI patterns (e.g., /login, /signin) over the same protocol, which is a behavioral indicator of a user being redirected from a scanned QR code to a malicious phishing landing page.
Detects anomalous Kerberos TGS ticket requests (Event ID 4769) using weak encryption (RC4/0x17) directed at multiple unique Service Principal Names (SPNs) from a single host or user within a short timeframe. This behavior is indicative of Kerberoasting, a technique used by attackers to harvest service account credentials for offline brute-force cracking.
This rule detects potentially malicious activity involving Service Principals in Microsoft Entra ID. It identifies two scenarios: 1) Impossible travel, where a service principal authenticates from two distinct geographic locations within a 60-minute window, and 2) Administrative modifications to a service principal's credentials or authentication methods (e.g., adding secrets, certificates, or MFA methods), which may indicate persistence or credential abuse.
Detects bulk file access or modifications involving sensitive files such as certificates (.pfx, .p12, .pem, .key), password manager vaults (.kdbx, .kdb), and files containing keywords related to credentials or logins. This behavior is indicative of an adversary staging or exfiltrating sensitive security material for further credential access.
Detects a single account requesting an abnormally high number of distinct Kerberos TGS (Ticket Granting Service) tickets for SPN-mapped accounts within a 15-minute window. This behavior is indicative of Kerberoasting, where an attacker requests service tickets to perform offline brute-force cracking of service account passwords, often used for lateral movement.
Detects anomalous authentication behavior where the same session token or identifier is utilized by multiple distinct IP addresses or User-Agent strings within a short timeframe. This behavior is indicative of Adversary-in-the-Middle (AiTM) attacks, such as those employing Evilginx, where an attacker intercepts and replays stolen session cookies to bypass standard authentication and MFA controls.
Detects potential vishing or account takeover precursor activity where an external or guest Microsoft Teams user, impersonating IT or Help Desk support, communicates with a user who subsequently modifies their credentials or MFA configuration within the same 24-hour period.
Detects instances where a process not associated with standard web browsers accesses, copies, or modifies sensitive browser files such as cookies, local storage, or session tokens. This behavior is highly indicative of information-stealer malware (e.g., Vidar, Lumma, RedLine) attempting to exfiltrate session data for account hijacking.
Detects high or medium severity security alerts related to Kerberos Golden Ticket forgery, as identified by Microsoft Defender for Identity. This rule filters for specific alert names indicative of forged TGTs minted from the krbtgt account, excluding generic or informational ticket anomalies.
Page 23 of 206