Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,440
11,814
5,871
5,145
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects high-risk sign-in events in Azure AD that exhibit indicators of token replay, impossible travel, or anomalous sessions, while simultaneously leveraging certificate-based authentication or valid Primary Refresh Tokens (PRT). This combination often indicates an adversary is using stolen session material or PRTs to establish persistent, MFA-exempt access to the environment.
Detects the reuse of a single authenticated session or refresh token from multiple distinct IP addresses or ASN origins within a short timeframe following a successful MFA event. This pattern is indicative of session hijacking, where an adversary uses an Adversary-in-the-Middle (AiTM) toolkit (e.g., Evilginx) to capture a valid session cookie from a victim and replay it from their own infrastructure to bypass authentication.
Detects sign-in activity where an attacker or user fails a phishing-resistant MFA challenge (such as FIDO2, Windows Hello, or Passwordless Phone) and immediately succeeds using a lower-assurance, phishable factor (SMS, Voice call, or Push notification). This pattern is indicative of an Adversary-in-the-Middle (AiTM) attack attempting to bypass stronger authentication methods.
Detects high-volume, automated attempts to validate AWS credentials (access keys) from a single source IP address within a short time window. This pattern, characterized by a large number of distinct access keys being tested against identity-confirming API calls (e.g., GetCallerIdentity, AssumeRole) with a mix of success and failure, is indicative of automated credential harvesting or reconnaissance campaigns.
Detects successful sign-in events flagged by the identity provider with risk indicators suggesting session token replay or theft. This includes anomalies such as unexpected token issuers, suspicious browsers, or unfamiliar device features, which are characteristic of session cookie theft and replay attacks.
The following analytic detects a process requesting PROCESS_TERMINATE access to Lsass.exe.
It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_TERMINATE (0x1).
It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_TERMINATE (0x1).
Detects instances where a suspicious login event (such as a risk challenge) is immediately followed by a credential or recovery information modification. This pattern may indicate an adversary is attempting to take over a compromised account by resetting the password or recovery details after triggering a security alert.
Detects Kerberos TGS (Service Ticket) requests utilizing the insecure RC4 encryption type (0x17). This pattern is a hallmark of Kerberoasting, where an attacker requests service tickets for SPNs in an attempt to crack the service account credentials offline.
Detects a sequence of suspicious activities associated with credential dumping and inhibiting system recovery. The rule tracks when a user account executes multiple commands related to volume shadow copies (vssadmin, rmdir, mklink) or attempts to copy sensitive registry files (SAM, SYSTEM, SECURITY) within a 15-minute window on the same device.
Detects instances where browser processes (Chrome or Edge) are spawned by smartscreen.exe and subsequently access sensitive browser storage files such as Login Data, Cookies, or Local State. This pattern is indicative of a process injection or masquerading chain used to extract credentials or session data.
Detects potential Adversary-in-the-Middle (AiTM) session token theft by monitoring for an initial interactive sign-in followed shortly by a non-interactive token refresh from a different IP address and browser fingerprint without a multi-factor authentication (MFA) challenge. This behavior is indicative of an adversary replaying captured session cookies via reverse-proxy infrastructure.
Detects potential Adversary-in-the-Middle (AiTM) session token theft by monitoring for an initial interactive sign-in followed shortly by a non-interactive token refresh from a different IP address and browser fingerprint without a multi-factor authentication (MFA) challenge. This behavior is indicative of an adversary replaying captured session cookies via reverse-proxy infrastructure.
Detects suspicious help-desk activity where a user password is reset by an administrator followed shortly by a new MFA factor being enrolled for that same user. This pattern is characteristic of Scattered Spider-style social engineering and vishing attacks to bypass MFA without deploying malware.
Detects suspicious help-desk activity where a user password is reset by an administrator followed shortly by a new MFA factor being enrolled for that same user. This pattern is characteristic of Scattered Spider-style social engineering and vishing attacks to bypass MFA without deploying malware.
Detects anomalous activity in a CI/CD environment where a runner process accesses sensitive credential files (such as PyPI tokens or GitHub secrets) followed closely by a network connection to public package registry domains, potentially indicating a supply-chain compromise where stolen credentials are used to publish malicious packages.
Detects Python processes (python.exe, python3.exe, pythonw.exe) loading native library files (.pyd or .so) followed by file access to sensitive browser credential and cookie storage locations (e.g., Login Data, Cookies, Local State). This pattern is characteristic of infostealer activity, where a Python script uses a native module to decrypt or extract browser-stored credentials.
Detects potential Remus infostealer activity by monitoring unauthorized processes accessing AI agent credential directories (Claude, Cursor, OpenCode, Codex) or cryptocurrency wallet files, specifically when combined with .lnk shortcut file access behavior.
Detects coordinated credential stuffing campaigns originating from shared IP infrastructure. The rule identifies patterns where multiple distinct accounts are targeted with failed sign-in attempts, characterized by rapidly rotating user-agent/device fingerprints while remaining under standard per-account and per-IP throttling limits. It focuses on the combination of high unique account counts, rotating user-agents, and sustained activity over a specific time window.
Detects Node.js or ProfileQuickHost processes performing file operations (read, write, rename) on sensitive browser directories, such as 'Local Extension Settings' or wallet-related folders. This pattern is commonly observed in credential-stealing malware attempting to extract browser-stored secrets or cryptocurrency wallet data.
This rule detects potential quishing (QR code phishing) attempts by identifying emails with one or more image attachments and minimal URL content, followed by a risky user authentication event within a 3-hour window. This behavior is indicative of an attacker attempting to harvest credentials via a malicious QR code that redirects the user to a phishing site.
This rule detects potential quishing (QR code phishing) attempts by identifying emails with one or more image attachments and minimal URL content, followed by a risky user authentication event within a 3-hour window. This behavior is indicative of an attacker attempting to harvest credentials via a malicious QR code that redirects the user to a phishing site.
Page 33 of 206