Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,440
11,814
5,871
5,145
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
This rule detects HTTP requests to the Microsoft device login endpoint (/devicelogin) that originate from a non-Microsoft referrer domain. This behavior is highly indicative of Adversary-in-the-Middle (AiTM) phishing attacks targeting OAuth device code flows, where a malicious proxy site redirects users to the legitimate Microsoft login page while attempting to capture session tokens.
This rule detects non-standard processes attempting to access sensitive web browser files (e.g., 'Login Data', 'Cookies', 'key4.db') that are typically only accessed by legitimate web browsers. It excludes known browser processes and trusted security or sync applications to identify potential credential theft attempts.
This rule detects non-standard processes attempting to access sensitive web browser files (e.g., 'Login Data', 'Cookies', 'key4.db') that are typically only accessed by legitimate web browsers. It excludes known browser processes and trusted security or sync applications to identify potential credential theft attempts.
Detects suspicious use of Windows API functions (SetWindowsHookEx) often associated with keylogging, correlated with the presence of temporary staging files in common directories (e.g., Temp, AppData). The rule excludes known legitimate applications that frequently utilize system hooks.
Detects several potentially malicious activities related to Active Directory Certificate Services (AD CS). This includes high volumes of failed requests (potential enumeration), requests for sensitive templates (privilege escalation), and potential impersonation attempts using Subject Alternative Names (SANs). These activities are associated with AD CS abuse techniques.
Detects anomalous cloud authentication events occurring within a 3-hour window after suspected unauthorized access to sensitive configuration or credential files on a Vite development server. The rule flags sign-ins with high risk, anomalous location, or missing device compliance information, excluding trusted corporate locations and devices, serving as an indicator of potential post-exfiltration account takeover.
This rule detects non-browser processes attempting to access sensitive web browser credential files, such as 'Login Data', 'logins.json', and 'key4.db'. Such activity is highly characteristic of credential-stealing malware (including BabylonRAT) attempting to exfiltrate stored passwords or session data from Google Chrome or Mozilla Firefox profiles.
Detects unauthorized processes attempting to access browser credential database files such as Login Data for Chromium-based browsers or logins.json and key4.db for Firefox. The rule filters out known browser processes to isolate potential credential harvesting or exfiltration activity.
Detects DCSync activity, a method of credential dumping, by identifying DRSUAPI 'GetNCChanges' replication requests originating from a host that is not a recognized Domain Controller. The rule uses Active Directory replication GUIDs, explicit operation logs, and enriches host data to filter for illegitimate sources.
This rule detects potential OAuth token theft resulting from device code phishing (e.g., N0va phishkit). It monitors for a successful OAuth device-code authentication followed within 5 minutes by a secondary successful sign-in for the same user from a different IP address, different browser client, or different user agent, which is a common indicator of an adversary-in-the-middle (AiTM) session hijacking attempt.
Detects instances where a service principal or entity identified as an AI agent, bot, or assistant accesses files in SharePoint or OneDrive that are likely to contain sensitive credentials, secrets, or configuration files (e.g., .pem, .pfx, .env, id_rsa).
This rule detects potentially malicious activity targeting Microsoft Entra Connect (formerly Azure AD Connect) servers. It identifies the execution of known credential harvesting tools like AADInternals or attempts to access/extract the ADSync database files and encryption components. Such actions indicate an attempt to gain unauthorized access to synchronized identities, local domain credentials, or cloud synchronization service accounts.
Detects attempts to bypass authentication on Nacos servers, including the use of spoofed Nacos-Server User-Agent headers, suspicious API query patterns missing required access tokens, and the subsequent use of forged JWT tokens signed with default keys.
Detects unauthorized access to sensitive browser files, specifically 'Login Data' (passwords) and 'Cookies', by processes other than authorized browser binaries (Chrome or Edge). This is a common indicator of credential harvesting or session hijacking attempts by malware or malicious actors.
Detects execution of AI coding assistants or CLI tools (such as Claude, Gemini, Copilot, etc.) that are attempting to access sensitive local configuration, credential, or authentication files, including SSH keys, AWS credentials, and browser cookies.
This rule detects suspicious process injection activity directed at Chrome or Edge browser processes, followed immediately by file access to sensitive browser data files like 'Login Data' or 'Cookies'. This pattern is indicative of an adversary attempting to steal credentials or session cookies from a user's web browser memory and disk storage.
Detects instances where AI-assisted coding tools or command-line interfaces spawn scripting runtimes (Node.js, Python) to access sensitive files such as SSH keys, cloud provider credentials, or Kubernetes configurations. This behavior may indicate an AI coding assistant being coerced or misconfigured to exfiltrate secrets from the development environment.
Detects when AI-powered coding assistant plugins or CLI tools (e.g., Claude, Copilot, Gemini) execute subprocesses that attempt to access sensitive configuration files, SSH keys, or cloud credential stores. This may indicate an AI tool being manipulated or misconfigured to exfiltrate sensitive local secrets.
This rule detects potential credential dumping attempts targeting the Local Security Authority Subsystem Service (LSASS) process. It identifies suspicious file execution based on a blocklist of known credential dumping utility hashes, unauthorized OpenProcess calls to lsass.exe with specific access rights, and the creation of process memory dump files (e.g., .dmp, .dump) correlated with an lsass.exe access event.
This rule detects potential credential dumping attempts targeting the Local Security Authority Subsystem Service (LSASS) process. It identifies suspicious file execution based on a blocklist of known credential dumping utility hashes, unauthorized OpenProcess calls to lsass.exe with specific access rights, and the creation of process memory dump files (e.g., .dmp, .dump) correlated with an lsass.exe access event.
Detects unauthorized processes attempting to modify, create, or rename sensitive browser files (Login Data or Cookies) belonging to Google Chrome or Microsoft Edge. The rule filters out known browser processes and looks for suspicious initiating processes characterized by unsigned code or execution from common staging areas like Temp folders.
Page 41 of 206