Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,440
11,829
5,874
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects Ruby source files containing a hardcoded RubyGems API key (rubygems_ prefixed token) used for unauthorized gem publish/push actions, as seen in the yardxabc889 package from the GemStuffer campaign
Detects anomalous outbound HTTP requests to the Google OAuth token endpoint that mimic the behavior of the JSCeal malware. The rule identifies requests that lack standard browser-based User-Agent strings and omit the 'code_verifier' parameter, which is typically required in legitimate PKCE-enabled OAuth flows, indicating potential automated token theft.
Detects anomalous outbound HTTP requests to the Google OAuth token endpoint that mimic the behavior of the JSCeal malware. The rule identifies requests that lack standard browser-based User-Agent strings and omit the 'code_verifier' parameter, which is typically required in legitimate PKCE-enabled OAuth flows, indicating potential automated token theft.
Detects a potential Kerberoasting attempt by identifying a single user or IP requesting multiple RC4-encrypted Ticket Granting Service (TGS) tickets for distinct service accounts within a short timeframe. Kerberoasting involves requesting TGS tickets for service accounts, which are then used for offline brute-force cracking of the service account's password hash.
Detects unauthorized processes (e.g., cmd.exe, powershell.exe, node.exe) accessing sensitive web browser files like 'Login Data' or 'Cookies' in common browser directories. This behavior is indicative of credential theft or data exfiltration attempts.
This rule detects potentially unauthorized access or large-scale extraction of sensitive RADIUS server configuration and credential databases. It monitors for common database management tools and commands used in conjunction with RADIUS-specific paths, particularly when executed by unexpected processes, during off-hours, or in a manner indicative of bulk data export.
This rule detects potentially unauthorized access or large-scale extraction of sensitive RADIUS server configuration and credential databases. It monitors for common database management tools and commands used in conjunction with RADIUS-specific paths, particularly when executed by unexpected processes, during off-hours, or in a manner indicative of bulk data export.
This rule detects attempts to exploit the LiteLLM proxy pass-through endpoint to interact with the cloud Instance Metadata Service (IMDS). Specifically, it identifies configuration attempts to route traffic to the IMDS IP (169.254.169.254) and subsequent requests to retrieve IAM security credentials, which is indicative of a Server-Side Request Forgery (SSRF) attack to steal cloud identity tokens.
Detects network-based exploitation attempts against Dahua Easy4IP P2P relay infrastructure, including reconnaissance probes, unauthorized relay usage, and credential theft attempts via WSSE authentication.
Detects PEEP credential/session theft via the native-messaging bridge, native host registration, staged CRX, or extension ID references. The nm_host.exe branch is now anchored to the known PEEP extension IDs (primary and alternate build) or the com.peep.lab path, rather than firing on any nm_host.exe spawned by a browser.
Detects PEEP credential/session theft via the native-messaging bridge, native host registration, staged CRX, or extension ID references. The nm_host.exe branch is now anchored to the known PEEP extension IDs (primary and alternate build) or the com.peep.lab path, rather than firing on any nm_host.exe spawned by a browser.
Detects high-frequency creation and revocation of service principal credentials, indicating potential malicious credential cycling, or unusual bursts of service account JWT/refresh token rotation across multiple IP addresses, which may indicate an attempt to evade detection or maintain persistence.
Detects high-frequency creation and revocation of service principal credentials, indicating potential malicious credential cycling, or unusual bursts of service account JWT/refresh token rotation across multiple IP addresses, which may indicate an attempt to evade detection or maintain persistence.
Detects anomalous authentication attempts where a single source IP validates a high volume of distinct Service Principal or App Client IDs within a short timeframe with a high failure rate. This pattern is indicative of attackers performing bulk validation of stolen API keys or OAuth credentials, likely harvested through mobile application decompilation (APK/IPA analysis).
This rule monitors for high-volume, suspicious activity involving the enumeration of sensitive cloud resources across multiple Azure services (e.g., Kubernetes cluster secrets, KeyVault secrets, Backup vault items, and DataFactory/Web connections). An alert is triggered when a single identity performs a high number of operations across multiple distinct resource types within a one-hour window, which is indicative of credential harvesting or cloud reconnaissance.
This rule monitors for high-volume, suspicious activity involving the enumeration of sensitive cloud resources across multiple Azure services (e.g., Kubernetes cluster secrets, KeyVault secrets, Backup vault items, and DataFactory/Web connections). An alert is triggered when a single identity performs a high number of operations across multiple distinct resource types within a one-hour window, which is indicative of credential harvesting or cloud reconnaissance.
This rule monitors for high-volume, suspicious activity involving the enumeration of sensitive cloud resources across multiple Azure services (e.g., Kubernetes cluster secrets, KeyVault secrets, Backup vault items, and DataFactory/Web connections). An alert is triggered when a single identity performs a high number of operations across multiple distinct resource types within a one-hour window, which is indicative of credential harvesting or cloud reconnaissance.
This rule monitors for high-volume, suspicious activity involving the enumeration of sensitive cloud resources across multiple Azure services (e.g., Kubernetes cluster secrets, KeyVault secrets, Backup vault items, and DataFactory/Web connections). An alert is triggered when a single identity performs a high number of operations across multiple distinct resource types within a one-hour window, which is indicative of credential harvesting or cloud reconnaissance.
Detects processes that access sensitive browser credential or cookie files (e.g., Login Data, Cookies) followed by network activity within a 10-minute window, which is a common behavior pattern of information-stealing malware such as Amatera or ACR Stealer.
Detects a single process accessing multiple distinct sensitive files related to cryptocurrency wallets, SSH keys, or seed phrases within a short duration. This pattern of bulk file access is highly indicative of automated credential harvesting modules like those found in the CRPx0 malware family.
Detects the addition of a 'msDS-KeyCredentialLink' attribute to an Active Directory object (Event 5136), which is indicative of the Shadow Credentials attack vector, followed by a successful PKINIT authentication (Event 4768) for that account. This combination suggests that an adversary has successfully established persistent access using a forged or unauthorized device credential and is now utilizing it for authentication.
Page 54 of 206