Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,438
11,829
5,872
5,150
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects coordinated credential stuffing campaigns originating from shared IP infrastructure. The rule identifies patterns where multiple distinct accounts are targeted with failed sign-in attempts, characterized by rapidly rotating user-agent/device fingerprints while remaining under standard per-account and per-IP throttling limits. It focuses on the combination of high unique account counts, rotating user-agents, and sustained activity over a specific time window.
Detects Node.js or ProfileQuickHost processes performing file operations (read, write, rename) on sensitive browser directories, such as 'Local Extension Settings' or wallet-related folders. This pattern is commonly observed in credential-stealing malware attempting to extract browser-stored secrets or cryptocurrency wallet data.
This rule detects potential quishing (QR code phishing) attempts by identifying emails with one or more image attachments and minimal URL content, followed by a risky user authentication event within a 3-hour window. This behavior is indicative of an attacker attempting to harvest credentials via a malicious QR code that redirects the user to a phishing site.
This rule detects potential quishing (QR code phishing) attempts by identifying emails with one or more image attachments and minimal URL content, followed by a risky user authentication event within a 3-hour window. This behavior is indicative of an attacker attempting to harvest credentials via a malicious QR code that redirects the user to a phishing site.
Detects rapid, machine-speed, sequential attack-path adaptation by suspected AI agent binaries. The rule monitors for a correlation of four stages occurring within a tight 20-minute window: 1) Failed service connections across three or more distinct protocols (SMB, SSH, HTTP, RDP, WinRM), 2) Credential access attempts (Logon events or execution of known credential-dumping tools), and 3) A lateral movement pivot to a new, previously un-targeted internal destination. The rule specifically keys on the InitiatingProcessId and InitiatingProcessCreationTime to ensure the sequence is attributed to a single process instance, distinguishing it from human manual penetration testing activity. Covers T1190, T1210, T1078
Detects instances where Chrome or Microsoft Edge processes are spawned from suspicious AppData subdirectories that do not match standard installation paths. This behavior is indicative of credential theft malware, such as RevStealer, which launches browser processes as debugged child processes from unique working directories to recover App-Bound encryption keys.
Detects unauthorized processes reading sensitive Chromium-based browser files (e.g., Cookies, Login Data) immediately following the termination of a browser process. This behavior is indicative of credential harvesting malware, such as RevStealer, which terminates the browser to release file locks before exfiltrating the databases.
Detects a single process accessing files across three or more distinct cryptocurrency wallet application directories within a one-hour window. This behavior is highly anomalous for legitimate applications and is characteristic of information-stealing malware, such as RevStealer, which targets stored credentials and wallet files.
Detects unauthorized access to critical Chromium-based browser credential databases (such as Login Data, Cookies, and History) by processes other than recognized browser executables. This behavior is indicative of credential-harvesting activity, specifically matching techniques employed by infostealers like RevStealer.
Detects non-browser processes accessing sensitive browser credential stores (e.g., Login Data, Cookies) and cryptocurrency wallet files within a short time window. This pattern is characteristic of infostealer malware like Vidar, which grabs browser and wallet data for exfiltration.
Detects web browser processes (Chrome, Edge, Firefox, Brave, Opera, IE) being spawned by a parent process that is not part of the standard, trusted application launch lineage. This pattern is commonly observed in credential-stealing malware like Vidar Stealer, which invokes browsers to access and exfiltrate stored browser data.
This rule detects unauthorized access, creation, or modification of Git credential files (.git-credentials, .netrc) by processes other than standard Git credential management utilities. It also monitors command-line activity that references these credential stores to identify potential attempts to exfiltrate or manipulate stored credentials.
Detects a potential OAuth device code phishing abuse pattern where an authenticated device code sign-in is immediately followed by a new device registration or Primary Refresh Token (PRT) issuance for the same user, potentially originating from a different device or IP address.
Detects the use of anomalous session tokens in Azure Active Directory (Azure AD) sign-in events where the token is being used in a non-interactive manner without a corresponding interactive authentication event. This behavior is indicative of token theft or infostealer activity, where an adversary replays a stolen session cookie from a new, untrusted, or non-compliant device to bypass authentication protections.
Detects a burst of multiple MFA push authentication denial events for a single user within a 10-minute window, indicative of an MFA fatigue (push-bombing) attack. This behavior is often followed by an attempt to wait for the user to inadvertently approve the notification.
Detects instances where common browser credential and cookie storage files (Login Data, Cookies) for Google Chrome or Microsoft Edge are accessed by non-browser processes such as PowerShell, csc.exe, or the Search Indexer. This behavior is highly indicative of credential theft or session hijacking attempts.
Detects an identity that performs a 'ListSecrets' operation followed by a high volume of 'GetSecretValue' or 'BatchGetSecretValue' requests within a short timeframe (15 minutes). This behavioral pattern is indicative of automated bulk exfiltration of secrets from AWS Secrets Manager, a common activity following an initial cloud environment compromise.
Detects a multi-stage phishing attack targeting cryptocurrency users, specifically Ledger wallet holders. The detection identifies an initial request to a Vercel-hosted domain for a BIP-39 wordlist (a common recovery phrase standard) followed by a POST request to a similar Vercel-hosted endpoint, suggesting the exfiltration of a secret recovery phrase.
Detects a multi-stage phishing attack targeting cryptocurrency users, specifically Ledger wallet holders. The detection identifies an initial request to a Vercel-hosted domain for a BIP-39 wordlist (a common recovery phrase standard) followed by a POST request to a similar Vercel-hosted endpoint, suggesting the exfiltration of a secret recovery phrase.
Detects a multi-stage phishing attack targeting cryptocurrency users, specifically Ledger wallet holders. The detection identifies an initial request to a Vercel-hosted domain for a BIP-39 wordlist (a common recovery phrase standard) followed by a POST request to a similar Vercel-hosted endpoint, suggesting the exfiltration of a secret recovery phrase.
Detects anomalous Kerberos TGS (Ticket Granting Service) requests using weak RC4-HMAC (0x17) encryption. The rule looks for accounts requesting multiple service tickets for distinct Service Principal Names (SPNs) within a short time window, which is a common behavior pattern for tools like Rubeus or GetUserSPNs.py during the credential-harvesting phase of a Kerberoasting attack.
Page 34 of 206