Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,439
11,829
5,873
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects Kerberos TGT or TGS requests that either exhibit a suspicious combination of ticket flags (Forwardable + Proxiable + Renewable) when associated with high-value targets, unusual accounts, or off-hours activity, or utilize the weak RC4-HMAC encryption type, both of which are indicative of ticket manipulation and credential theft.
Detects anomalous cloud authentication events occurring within a 3-hour window after suspected unauthorized access to sensitive configuration or credential files on a Vite development server. The rule flags sign-ins with high risk, anomalous location, or missing device compliance information, excluding trusted corporate locations and devices, serving as an indicator of potential post-exfiltration account takeover.
Detects anomalous cloud authentication events occurring within a 3-hour window after suspected unauthorized access to sensitive configuration or credential files on a Vite development server. The rule flags sign-ins with high risk, anomalous location, or missing device compliance information, excluding trusted corporate locations and devices, serving as an indicator of potential post-exfiltration account takeover.
Detects anomalous cloud authentication events occurring within a 3-hour window after suspected unauthorized access to sensitive configuration or credential files on a Vite development server. The rule flags sign-ins with high risk, anomalous location, or missing device compliance information, excluding trusted corporate locations and devices, serving as an indicator of potential post-exfiltration account takeover.
Detects the execution of the Rubeus.exe utility with command-line arguments indicative of Kerberos-related credential harvesting and abuse, such as Kerberoasting, AS-REP Roasting, and Pass-the-Ticket attacks.
Detects the execution of the Rubeus.exe utility with command-line arguments indicative of Kerberos-related credential harvesting and abuse, such as Kerberoasting, AS-REP Roasting, and Pass-the-Ticket attacks.
Detects the execution of the Rubeus.exe utility with command-line arguments indicative of Kerberos-related credential harvesting and abuse, such as Kerberoasting, AS-REP Roasting, and Pass-the-Ticket attacks.
This rule detects attempts to exploit the LiteLLM proxy pass-through endpoint to interact with the cloud Instance Metadata Service (IMDS). Specifically, it identifies configuration attempts to route traffic to the IMDS IP (169.254.169.254) and subsequent requests to retrieve IAM security credentials, which is indicative of a Server-Side Request Forgery (SSRF) attack to steal cloud identity tokens.
This rule detects non-standard processes attempting to access sensitive web browser files (e.g., 'Login Data', 'Cookies', 'key4.db') that are typically only accessed by legitimate web browsers. It excludes known browser processes and trusted security or sync applications to identify potential credential theft attempts.
This rule detects non-standard processes attempting to access sensitive web browser files (e.g., 'Login Data', 'Cookies', 'key4.db') that are typically only accessed by legitimate web browsers. It excludes known browser processes and trusted security or sync applications to identify potential credential theft attempts.
Detects suspicious use of Windows API functions (SetWindowsHookEx) often associated with keylogging, correlated with the presence of temporary staging files in common directories (e.g., Temp, AppData). The rule excludes known legitimate applications that frequently utilize system hooks.
Detects suspicious use of Windows API functions (SetWindowsHookEx) often associated with keylogging, correlated with the presence of temporary staging files in common directories (e.g., Temp, AppData). The rule excludes known legitimate applications that frequently utilize system hooks.
Detects suspicious use of Windows API functions (SetWindowsHookEx) often associated with keylogging, correlated with the presence of temporary staging files in common directories (e.g., Temp, AppData). The rule excludes known legitimate applications that frequently utilize system hooks.
Detects suspicious use of Windows API functions (SetWindowsHookEx) often associated with keylogging, correlated with the presence of temporary staging files in common directories (e.g., Temp, AppData). The rule excludes known legitimate applications that frequently utilize system hooks.
Detects high-volume credential guessing attacks against applications, characterized by a large number of distinct source IP addresses and geographic locations. This pattern is indicative of attackers using residential proxy pools to distribute their attempts, effectively bypassing traditional rate limiting or per-IP WAF thresholds while targeting authentication or error oracles. The rule specifically filters for relevant failure codes and enforces constraints on IP/user diversity to reduce noise from single-point-of-failure events or legitimate infrastructure.
Detects high-volume credential guessing attacks against applications, characterized by a large number of distinct source IP addresses and geographic locations. This pattern is indicative of attackers using residential proxy pools to distribute their attempts, effectively bypassing traditional rate limiting or per-IP WAF thresholds while targeting authentication or error oracles. The rule specifically filters for relevant failure codes and enforces constraints on IP/user diversity to reduce noise from single-point-of-failure events or legitimate infrastructure.
Detects high-volume credential guessing attacks against applications, characterized by a large number of distinct source IP addresses and geographic locations. This pattern is indicative of attackers using residential proxy pools to distribute their attempts, effectively bypassing traditional rate limiting or per-IP WAF thresholds while targeting authentication or error oracles. The rule specifically filters for relevant failure codes and enforces constraints on IP/user diversity to reduce noise from single-point-of-failure events or legitimate infrastructure.
Detects rapid, sequential identity-validation API calls (such as GetCallerIdentity, GetSessionToken, or AssumeRole) performed across a large number of distinct AWS access keys from a single source within a short time window. This pattern is indicative of automated tooling validating a harvested corpus of AWS access keys to identify active credentials.
Detects rapid, sequential identity-validation API calls (such as GetCallerIdentity, GetSessionToken, or AssumeRole) performed across a large number of distinct AWS access keys from a single source within a short time window. This pattern is indicative of automated tooling validating a harvested corpus of AWS access keys to identify active credentials.
Detects network connections to known JeetBot infrastructure domains and IP addresses. The rule specifically identifies potential exfiltration of Twitch OAuth tokens via URL parameters or interaction with known token-collection proxy endpoints, which are associated with the JeetBot/Twitch Enhanced Viewer credential harvesting campaign.
Detects Kerberos Ticket Granting Service (TGS) requests (Event ID 4769) that use RC4 encryption (0x17). In modern Active Directory environments, RC4 is considered weak and is often explicitly requested by attackers during Kerberoasting to facilitate offline brute-force cracking of service account passwords. The rule excludes common service accounts (e.g., krbtgt, machine accounts) to reduce noise.
Page 48 of 206