Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,438
11,829
5,873
5,150
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects instances where AI-assisted development tools (such as Claude, Codex, Copilot, or Gemini) initiate command-line processes (e.g., shells, interpreters, or network utilities) with arguments indicative of credential access, reconnaissance, or sensitive file interactions.
Detects the creation or abuse of Volume Shadow Copies specifically to access the NTDS.dit file or the SYSTEM registry hive, a common technique for offline Active Directory credential dumping.
Detects potential Pass-the-Hash (PtH) activity by monitoring Windows Security Event ID 4624 (Logon). The rule specifically targets logon type 9 (NewCredentials) combined with specific process/package names indicative of tools like Mimikatz, or anomalous NTLM network logons (logon type 3) that are not anonymous.
Detects an identity that performs a 'ListSecrets' operation followed by a high volume of 'GetSecretValue' or 'BatchGetSecretValue' requests within a short timeframe (15 minutes). This behavioral pattern is indicative of automated bulk exfiltration of secrets from AWS Secrets Manager, a common activity following an initial cloud environment compromise.
Detects Kerberoasting activity by identifying a high volume of RC4-encrypted (0x17) Kerberos Service Ticket (TGS) requests from a single user account against multiple distinct service principal names (SPNs) within a short timeframe. This behavior is highly indicative of automated credential harvesting tools such as Rubeus or Impacket.
Detects anomalous Kerberos ticket requests characteristic of Golden Ticket attacks. These forged tickets are created offline using the KRBTGT account hash, bypassing legitimate KDC TGT issuance, and frequently exhibit default Mimikatz artifacts such as RC4 encryption or extended ticket lifetimes.
Detects anomalous mass consent grants to OAuth applications by users within the environment. This rule monitors for high-risk permissions such as Mail.Read and Files.ReadWrite.All, which are commonly used in consent phishing and application-based persistence campaigns to gain unauthorized access to mailbox and file resources.
Detects potential N0va-style phishing or token-exchange abuse where a user completes a device-code authentication flow, followed immediately by an access token usage from a different IP address or device. This sequence indicates an adversary has captured the resulting token/session and is attempting to bypass multi-factor authentication (MFA) to gain unauthorized access to cloud resources.
The following analytic detects unauthorized access to Outlook credentials stored in the Windows registry.
It leverages Windows Security Event logs, specifically EventCode 4663, to identify access attempts to registry paths associated with Outlook profiles.
This activity is significant as it may indicate attempts to steal sensitive email credentials, which could lead to unauthorized access to email accounts.
If confirmed malicious, this could allow attackers to exfiltrate sensitive information, impersonate users, or execute further unauthorized actions within Outlook, posing a significant security risk.
It leverages Windows Security Event logs, specifically EventCode 4663, to identify access attempts to registry paths associated with Outlook profiles.
This activity is significant as it may indicate attempts to steal sensitive email credentials, which could lead to unauthorized access to email accounts.
If confirmed malicious, this could allow attackers to exfiltrate sensitive information, impersonate users, or execute further unauthorized actions within Outlook, posing a significant security risk.
This rule detects behaviors associated with the Hannibal Stealer, specifically the identification of the Bitcoin Core wallet directory via registry lookups (strDataDir) followed by the unauthorized copying of 'wallet.dat' files into a staging directory structure, commonly used for cryptocurrency wallet exfiltration.
Detects modifications, creation, or renaming of common cryptocurrency wallet files (e.g., wallet.dat, .wallet files) within known storage directories. This behavior is often associated with infostealers or malware attempting to exfiltrate or manipulate user financial assets.
Detects potential Remus infostealer activity by monitoring unauthorized processes accessing AI agent credential directories (Claude, Cursor, OpenCode, Codex) or cryptocurrency wallet files, specifically when combined with .lnk shortcut file access behavior.
Detects processes that systematically query registry keys associated with Outlook configuration and VNC remote access software (RealVNC, TightVNC, TigerVNC). Querying multiple distinct families of these sensitive keys in a short period is characteristic of automated reconnaissance by tools, such as the Remus malware framework, attempting to identify installed software and potential configuration details.
Detects potential Remus infostealer activity by monitoring unauthorized processes accessing AI agent credential directories (Claude, Cursor, OpenCode, Codex) or cryptocurrency wallet files, specifically when combined with .lnk shortcut file access behavior.
Detects suspicious processes accessing cryptocurrency wallet data files or web browser extension storage folders associated with popular crypto wallets. This behavior is indicative of credential theft or wallet data exfiltration by malware targeting digital assets.
This rule detects unauthorized access attempts by non-browser processes to specific browser extension storage directories. It focuses on directories associated with password managers, 2FA authenticators, and cryptocurrency wallets, as well as core browser credential files (e.g., Login Data, Cookies, logins.json). This behavior is characteristic of info-stealer malware, such as the Remus infostealer, attempting to exfiltrate sensitive data stored by browsers.
Detects access to sensitive files (KeePass databases, SSH private keys, and VPN configurations) by processes other than their designated applications. This behavior indicates potential credential harvesting or configuration exfiltration by unauthorized processes.
This rule detects potentially unauthorized access to Microsoft Graph API resources (Mail or Files) following a device-code authentication event for the same user. It identifies scenarios where a previously unknown application client performs read operations within 24 hours of a device-code login, which is characteristic of 'ARToken' or 'EvilProxy' type device-code phishing and session proxy attacks.
Detects interactive sign-ins to Microsoft Entra ID using the OAuth 2.0 device authorization grant flow. Attackers commonly abuse this flow in 'device code phishing' campaigns to capture access and refresh tokens, effectively bypassing MFA requirements.
This rule detects successful authentication to Azure/M365 identity and security management portals (My Sign-Ins, My Apps, My Profile) shortly after a risky or suspicious sign-in event for the same user. This pattern often indicates an account takeover scenario where an adversary, having potentially compromised credentials, immediately accesses account settings to perform further malicious actions, such as registering MFA devices or updating security proofs.
Detects potential Adversary-in-the-Middle (AiTM) phishing activity by monitoring specific Azure AD sign-in failure codes (50074: strong authentication is required, 50140: interruption of sign-in) in conjunction with logins from unmanaged devices.
Page 40 of 206