Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
AD CS ESC8 Certificate Request via NTLM
Cortex XDR
Detects Active Directory Certificate Services (AD CS) certificate requests that utilize NTLM authentication rather than Kerberos. This behavior is indicative of potential NTLM relay attacks (ESC8), where an attacker forces a machine account to authenticate to the AD CS web enrollment endpoint via NTLM to obtain a certificate on behalf of that machine.
Detects when a Node.js process initiates a low-level keyboard hook (WH_KEYBOARD_LL or WH_KEYBOARD) while running from common user-writable directories, which may indicate malicious keylogging activity by a suspicious process.
Detects anomalous authentication behavior where a user account utilizes the same authentication session (LogonId) or material to authenticate across multiple distinct destination hosts in a short timeframe. This rule monitors for both NTLM (Type 3) and Kerberos (TGS/TGT) events, which are indicative of lateral movement techniques such as Pass-the-Hash or Pass-the-Ticket.
Detects anomalous authentication behavior where a user account utilizes the same authentication session (LogonId) or material to authenticate across multiple distinct destination hosts in a short timeframe. This rule monitors for both NTLM (Type 3) and Kerberos (TGS/TGT) events, which are indicative of lateral movement techniques such as Pass-the-Hash or Pass-the-Ticket.
Detects unauthorized attempts to dump the process memory of the Local Security Authority Subsystem Service (LSASS), a common technique used by attackers to harvest credentials from memory. This includes the use of legitimate diagnostic tools like procdump and comsvcs.dll, as well as the identification of resulting dump files in directory paths associated with LSASS.
Detects processes other than the official Telegram desktop client accessing sensitive local data files ('key_datas', 'settingss', 'usertag') within the Telegram application directory. This activity is often associated with credential theft or session hijacking.
This rule detects file access, creation, modification, or renaming operations involving sensitive files associated with cryptocurrency wallets (Bitcoin, Electrum, ElectrumSV), game account configurations (Battle.net, Steam, Minecraft), and browser-based cookies (Roblox). The rule filters out legitimate process interactions, identifying suspicious activity from unknown or unauthorized applications potentially attempting to exfiltrate credentials or session tokens.
This rule detects file access, creation, modification, or renaming operations involving sensitive files associated with cryptocurrency wallets (Bitcoin, Electrum, ElectrumSV), game account configurations (Battle.net, Steam, Minecraft), and browser-based cookies (Roblox). The rule filters out legitimate process interactions, identifying suspicious activity from unknown or unauthorized applications potentially attempting to exfiltrate credentials or session tokens.
Detects a GitLab personal access token used from multiple distinct source IPs or from IPs associated with the leaked gitlab-triage token, inconsistent with expected CI runner infrastructure.
Detects a GitLab personal access token used from multiple distinct source IPs or from IPs associated with the leaked gitlab-triage token, inconsistent with expected CI runner infrastructure.
Detects GitLab's personal_access_tokens/self endpoint being queried via GET, the reconnaissance step a leaked token uses to confirm its own scopes and privilege level.
Detects GitLab's personal_access_tokens/self endpoint being queried via GET, the reconnaissance step a leaked token uses to confirm its own scopes and privilege level.
Detects the sensitive project-wide CI/CD variable API_TOKEN being exposed to job scopes other than the gitlab-triage automation job that is its only intended consumer, expanding the blast radius of the credential.
Detects the sensitive project-wide CI/CD variable API_TOKEN being exposed to job scopes other than the gitlab-triage automation job that is its only intended consumer, expanding the blast radius of the credential.
Detects the sensitive project-wide CI/CD variable API_TOKEN being exposed to job scopes other than the gitlab-triage automation job that is its only intended consumer, expanding the blast radius of the credential.
Detects GitLab CI job shell commands that redirect the environment to a .tmp file, a pattern identified in the GnuTLS GitLab token leak.
Detects CI/CD job activity referencing shell commands that redirect the entire environment to a file (e.g. 'env > out.tmp'), the exact pattern that caused a GitLab CI job in the openconnect/ocserv project to dump secrets into a public build artifact, leaking a high-privilege personal access token with Owner access to GnuTLS and 55 other critical projects.
Detects CI/CD job activity referencing shell commands that redirect the entire environment to a file (e.g. 'env > out.tmp'), the exact pattern that caused a GitLab CI job in the openconnect/ocserv project to dump secrets into a public build artifact, leaking a high-privilege personal access token with Owner access to GnuTLS and 55 other critical projects.
No description available.
Detects the execution of 'OmniQuery.pl' with command-line arguments indicative of direct database queries targeting sensitive authentication data (e.g., SELECT name, auth_data FROM users). This behavior suggests unauthorized access to database credentials or user information.
Detects instances where 'ERAAgent.exe', part of the ESET Remote Administrator agent, loads the 'dpapi.dll' library from a location outside of standard Windows System directories (System32 or SysWOW64). Furthermore, the rule flags this behavior if the loaded 'dpapi.dll' file is either unsigned or contains an untrusted digital signature, which may indicate a malicious DLL side-loading or masquerading attempt to access protected system credentials.
Page 58 of 206