Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,438
11,829
5,872
5,150
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects anomalous bursts of cloud secret or parameter retrieval API calls followed shortly by administrative actions that expose data or credentials (such as bucket policy changes or new key creation). This behavior is consistent with an adversary staging compromised credentials to exfiltrate data or maintain persistence.
Detects automated searching (via grep, findstr, or select-string) for sensitive strings (e.g., API keys, private keys, wallet data) across multiple occurrences on a single host, or the creation of suspicious sensitive files (e.g., .env, credentials, wallet.dat) on devices where such automated sweeping activity has been observed. This pattern indicates an adversary staging data for exfiltration.
Detects the use of rundll32.exe to execute comsvcs.dll's MiniDump functionality against the LSASS process, a common technique for dumping credentials. The rule includes behavioral correlation by identifying the same user account executing this pattern on multiple devices within a one-hour window.
Detects access to sensitive browser credential storage files (Login Data, key4.db, logins.json) by unauthorized processes. This behavior is indicative of credential theft, where an adversary attempts to extract stored passwords from browser profiles.
Detects access to sensitive browser credential storage files (Login Data, key4.db, logins.json) by unauthorized processes. This behavior is indicative of credential theft, where an adversary attempts to extract stored passwords from browser profiles.
Detects unauthorized access, modification, or creation of the FileZilla 'sitemanager.xml' configuration file by a process other than the legitimate 'filezilla.exe'. This is a common indicator of an adversary attempting to steal stored FTP credentials or modify connection configurations.
Detects potential Certificate Authority (CA) key theft by correlating command-line execution of certutil (with export flags) on a CA server with subsequent suspicious certificate issuance events. Suspicious issuance includes unauthorized certificate requests (missing event 4886), requests for high-privilege subjects (e.g., Domain Admins), or requests with unusually long validity periods.
Detects the execution of the Rubeus toolset with command-line arguments indicative of Kerberos ticket abuse, including Kerberoasting, AS-REP Roasting, and Pass-the-Ticket (PTT) techniques. These methods are commonly used by adversaries for credential harvesting and facilitating lateral movement within an Active Directory environment.
Detects high-velocity retrieval of multiple secrets from AWS Secrets Manager using a single IAM role or session shortly after activity initiation. This behavior is indicative of automated credential harvesting, often occurring post-compromise of a host (e.g., an SSH bastion) that has been assigned a high-privilege IAM role.
Detects the creation of a Volume Shadow Copy followed by an attempt to access or copy sensitive files, specifically the NTDS.dit database or the SYSTEM registry hive, from that shadow copy. This behavior is indicative of an attempt to perform offline credential theft.
Detects access to sensitive cryptocurrency wallet files (wallet.dat, seed phrases, keys) or the execution of Python processes from sensitive or commonly exploited directories (AppData, tmp, Public folders) associated with known malicious naming conventions (sys_service).
Detects the use of the 'getevent' debugging utility within an Android shell context (UID 2000) to monitor raw touch input events from /dev/input. This technique, often referred to as 'AdbTouchCapture', can be used to capture coordinate data from touchscreens, potentially bypassing system-level security controls like FLAG_SECURE to reconstruct user input, gestures, or PIN/pattern credentials.
Detects network activity associated with Mirage2FA Adversary-in-the-Middle (AiTM) phishing infrastructure. The rules monitor for HTTP responses containing specific spoofed Microsoft 365 sign-in page content, DNS resolutions for known proxy-associated domain suffixes, and client requests fetching malicious loader scripts from suspected AiTM hosting infrastructure.
Detects anomalous Microsoft 365 session behavior where a single SessionId persists across multiple sign-ins that originate from rotating IP addresses and ASNs. The detection identifies signs of potential session token theft, specifically looking for traffic matching the Microsoft Outlook client app signature paired with non-standard user agents (e.g., Firefox or Python requests) that exhibit recurring sign-in attempts at approximately 8-hour intervals, which is typical for automated token refresh cycles.
Detects network traffic indicating a potential adversary-in-the-middle (AiTM) phishing proxy attempting to relay authentication requests to the legitimate Microsoft login service. The rule triggers when an external host acts as a reverse proxy for login.microsoftonline.com endpoints without being the legitimate Microsoft service itself.
Detects anomalous sign-in attempts to the OfficeHome application where an OAuth 90014 error (nonce mismatch/invalid) is returned. The detection specifically monitors for requests originating from mobile browsers on Windows 10 user agents, which is indicative of potential adversary-in-the-middle (AiTM) phishing activity attempting to bypass or intercept authentication tokens.
Detects 'GetSecretValue' API calls to AWS Secrets Manager originating from programmatic agents like Boto3, Python requests, or the AWS CLI. This monitors for automated retrieval of stored secrets, which may indicate unauthorized credential access or exfiltration from an AWS environment.
Detects anomalous network polling patterns consistent with 'EvilTokens' or similar adversary-in-the-middle (AiTM) OAuth phishing kits. The rule identifies web browsers performing high-frequency, low-interval polling (3-6s) against non-reputable/unseen domains (the attacker-controlled status endpoint) immediately preceding or following successful Microsoft OAuth device-code authentication sequences.
Detects anomalous network polling patterns consistent with 'EvilTokens' or similar adversary-in-the-middle (AiTM) OAuth phishing kits. The rule identifies web browsers performing high-frequency, low-interval polling (3-6s) against non-reputable/unseen domains (the attacker-controlled status endpoint) immediately preceding or following successful Microsoft OAuth device-code authentication sequences.
Detects anomalous network polling patterns consistent with 'EvilTokens' or similar adversary-in-the-middle (AiTM) OAuth phishing kits. The rule identifies web browsers performing high-frequency, low-interval polling (3-6s) against non-reputable/unseen domains (the attacker-controlled status endpoint) immediately preceding or following successful Microsoft OAuth device-code authentication sequences.
Detects unauthorized processes (non-browser applications) creating, modifying, or renaming sensitive browser data files such as Login Data, Cookies, or local state files within standard browser profile directories. This activity is indicative of credential harvesting or session hijacking attempts by malicious software.
Page 36 of 206