Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,438
11,829
5,872
5,150
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects the creation of a Volume Shadow Copy followed by an attempt to access or copy sensitive files, specifically the NTDS.dit database or the SYSTEM registry hive, from that shadow copy. This behavior is indicative of an attempt to perform offline credential theft.
Detects the creation of a Volume Shadow Copy followed by an attempt to access or copy sensitive files, specifically the NTDS.dit database or the SYSTEM registry hive, from that shadow copy. This behavior is indicative of an attempt to perform offline credential theft.
Detects a sequence where an AWS Secrets Manager secret is retrieved via CloudTrail, followed within 30 minutes by an EDR-monitored process initiating an outbound network connection on a non-standard port (not 80 or 443). This behavior is consistent with an adversary using stolen credentials to pivot into a persistent command-and-control channel.
Detects infostealer malware (e.g., Vidar, Lumma, RedLine) that specifically searches for Claude/Anthropic session cookies, API tokens, and generic browser-based credential storage artifacts.
Detects unauthorized or non-standard processes attempting to access sensitive browser cookie storage files, which is a common technique used by credential-stealing malware to exfiltrate session data and bypass multi-factor authentication.
This rule detects suspicious PowerShell activity associated with the Lightlife RAT, specifically targeting Google Chrome's login data files to steal credentials and performing checks for the presence of cryptocurrency wallets.
Detects network activity associated with the GhostCode phishing kit backend. The rule monitors for specific API endpoints used for credential and MFA harvesting, including loading configurations, geolocation, and polling for captured data, combined with specific session cookie identifiers.
Detects suspicious non-interactive Entra ID sign-in events using the 'python-requests' User-Agent against sensitive Microsoft resources such as Microsoft Graph, Device Registration, or Intune. This activity is indicative of automated token abuse, particularly in the context of device-code phishing kits (e.g., GhostCode), where an attacker uses stolen session information to interact with Microsoft APIs.
StealC v2, the payload consistently delivered via FileFix campaigns, is capable of stealing cryptocurrency wallet data alongside credentials and VPN configs.
Detects anomalous network polling patterns consistent with 'EvilTokens' or similar adversary-in-the-middle (AiTM) OAuth phishing kits. The rule identifies web browsers performing high-frequency, low-interval polling (3-6s) against non-reputable/unseen domains (the attacker-controlled status endpoint) immediately preceding or following successful Microsoft OAuth device-code authentication sequences.
Detects automated post-compromise mailbox reconnaissance following an anomalous OAuth device code sign-in that exhibits high-risk indicators. The rule identifies programmatic access to a high volume of mail items within a short window following suspicious token issuance, which is characteristic of automated scanning or data exfiltration tooling.
Detects unauthorized access or decryption attempts related to Group Policy Preferences (GPP) files stored in SYSVOL. Adversaries often target these XML files to extract embedded 'cpassword' attributes, which can be decrypted using publicly known keys to obtain plain-text administrative credentials.
Detects rapid, machine-speed, sequential attack-path adaptation by suspected AI agent binaries. The rule monitors for a correlation of four stages occurring within a tight 20-minute window: 1) Failed service connections across three or more distinct protocols (SMB, SSH, HTTP, RDP, WinRM), 2) Credential access attempts (Logon events or execution of known credential-dumping tools), and 3) A lateral movement pivot to a new, previously un-targeted internal destination. The rule specifically keys on the InitiatingProcessId and InitiatingProcessCreationTime to ensure the sequence is attributed to a single process instance, distinguishing it from human manual penetration testing activity. Covers T1190, T1210, T1078
Detects rapid, machine-speed, sequential attack-path adaptation by suspected AI agent binaries. The rule monitors for a correlation of four stages occurring within a tight 20-minute window: 1) Failed service connections across three or more distinct protocols (SMB, SSH, HTTP, RDP, WinRM), 2) Credential access attempts (Logon events or execution of known credential-dumping tools), and 3) A lateral movement pivot to a new, previously un-targeted internal destination. The rule specifically keys on the InitiatingProcessId and InitiatingProcessCreationTime to ensure the sequence is attributed to a single process instance, distinguishing it from human manual penetration testing activity. Covers T1190, T1210, T1078
Detects rapid, machine-speed, sequential attack-path adaptation by suspected AI agent binaries. The rule monitors for a correlation of four stages occurring within a tight 20-minute window: 1) Failed service connections across three or more distinct protocols (SMB, SSH, HTTP, RDP, WinRM), 2) Credential access attempts (Logon events or execution of known credential-dumping tools), and 3) A lateral movement pivot to a new, previously un-targeted internal destination. The rule specifically keys on the InitiatingProcessId and InitiatingProcessCreationTime to ensure the sequence is attributed to a single process instance, distinguishing it from human manual penetration testing activity. Covers T1190, T1210, T1078
Detects a potential OAuth device code phishing abuse pattern where an authenticated device code sign-in is immediately followed by a new device registration or Primary Refresh Token (PRT) issuance for the same user, potentially originating from a different device or IP address.
This rule detects the creation of XML files matching the 'export_batch_*.xml' naming convention, which is consistent with the output pattern of the Dahua DeviceManager utility. Attackers often use this tool to export camera configuration files containing sensitive credentials (IP, Port, Username, Password). The rule flags activity where multiple such files are created in a short duration, suggesting potential mass exfiltration of camera credentials.
Detects unauthorized access to the Directory Replication Service (DRS) using Event ID 4662. The rule looks for access requests to sensitive Active Directory replication objects (GUIDs 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 and 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2) initiated by accounts other than Domain Controller machine accounts, which is a signature behavior of tools like Mimikatz lsadump::dcsync or Impacket's secretsdump.py.
Detects a single user account performing an unusually high volume of Kerberos Service Ticket (TGS) requests (Event ID 4769) within a short window, specifically using RC4 encryption (0x17). This behavior is highly characteristic of Kerberoasting, where attackers request tickets for various service principal names (SPNs) to perform offline password cracking.
Detects techniques associated with LSASS process credential dumping, including direct handle access to the LSASS process with specific access masks (common in tools like Mimikatz), the use of rundll32.exe to invoke comsvcs.dll for memory dumping, and the creation of LSASS dump files on disk.
Detects the issuance or renewal of Kerberos Ticket-Granting Tickets (TGT) (Event IDs 4768 and 4769) where the ticket lifetime or renewal duration exceeds standard Windows domain Kerberos policy defaults (typically 10 hours for lifetime and 7 days for renewal). Deviations from these standard thresholds are common indicators of forged Golden Tickets created using an exfiltrated KRBTGT hash.
Page 28 of 206