Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Surfaces Silverfort-detected incidents excluding ImpossibleTravel (high FP rate from VPN and mobile users, better covered by XSIAM Analytics UEBA)
Detects the use of osascript to generate fake macOS system-style dialog boxes that solicit user credentials or administrator privileges. This technique is often employed by macOS infostealers to conduct GUI-based credential harvesting or to bypass user interaction requirements for privilege escalation.
This rule detects potential unauthenticated access or unauthorized configuration modifications to an AI agent management backend. It monitors HTTP logs for requests targeting configuration endpoints that lack proper authentication, specifically identifying attempts to retrieve sensitive information like Dify or Coze keys, or attempts to inject new agent configurations via unauthenticated POST requests.
This rule monitors for high or medium-risk user events and sign-in activities within Azure Active Directory. It correlates data from both the AADUserRiskEvents and SigninLogs tables to identify potentially compromised user accounts.
Detects instances where 'ERAAgent.exe', part of the ESET Remote Administrator agent, loads the 'dpapi.dll' library from a location outside of standard Windows System directories (System32 or SysWOW64). Furthermore, the rule flags this behavior if the loaded 'dpapi.dll' file is either unsigned or contains an untrusted digital signature, which may indicate a malicious DLL side-loading or masquerading attempt to access protected system credentials.
Detects instances where processes other than the primary web browsers (Chrome, Brave, Firefox) create, rename, or modify sensitive browser data files like 'Cookies' or 'Login Data'. This behavior is indicative of credential theft or data exfiltration attempts where an adversary is accessing browser-stored information.
Detects the use of rundll32.exe to invoke the MiniDump export function of comsvcs.dll to create a memory dump of the LSASS process. This technique is often associated with post-exploitation credential access tools like lsassy or manual execution via remote management tools (e.g., WMI, MMC) by threat actors such as those in the Bumblebee/Akira ransomware intrusion chain.
Detects file creation, modification, or rename activity involving filenames that contain credential related indicators. The detection focuses on common document, spreadsheet, text, PDF, and archive formats that are frequently used to store sensitive authentication material. Such files may represent exposed credentials that could be leveraged by adversaries for credential access, privilege escalation, or lateral movement following endpoint compromise.
This rule detects the use of the 'security' command-line utility on macOS to access or dump contents from the login keychain, specifically targeting the 'login.keychain-db' file or attempting to retrieve generic passwords. This behavior is indicative of credential access attempts where an adversary is trying to extract sensitive information, such as passwords or keys, stored within the macOS Keychain.
Detects instances where the Google Chrome browser is executed with flags that disable the sandbox security feature, such as --no-sandbox and --allow-no-sandbox-job. This configuration is often used by adversaries to facilitate credential dumping from the browser by bypassing sandbox restrictions that typically prevent unauthorized process memory access.
Detects ERAAgent.exe (ESET Remote Administrator Agent) interacting with suspicious named pipes (e.g., mojo, spoolss) and attempts to extract credentials from command line parameters, indicating potential credential dumping or lateral movement techniques using the agent process.
This rule detects the use of the 'security' command-line utility on macOS to access or dump contents from the login keychain, specifically targeting the 'login.keychain-db' file or attempting to retrieve generic passwords. This behavior is indicative of credential access attempts where an adversary is trying to extract sensitive information, such as passwords or keys, stored within the macOS Keychain.
This rule detects potential session token replay attacks in Azure Active Directory by correlating interactive or single-factor sign-in events using 'python-requests' user agents (common in automated tooling) with subsequent 'Register device' and 'Register security info' (Windows Hello for Business) activity within a 48-hour window. This behavior often indicates an adversary attempting to register a device to a compromised account to maintain persistence or bypass MFA requirements.
Detects behavioral indicators associated with the ChocoShell malware, a fileless PowerShell-based infostealer. The rule monitors for malicious command-line activity including AMSI bypass, credential theft from Token Broker and WLAN profiles, disabling of Microsoft Defender signatures, and communication with local API endpoints typical of the CornFlake controller.
This rule detects suspicious activity involving common web browser credential files (Cookies, Login Data) being read, created, modified, or renamed by processes associated with iCloud synchronization paths on macOS. This behavior is indicative of potentially malicious processes attempting to exfiltrate browser-stored session information or credentials.
Detects unauthorized, non-browser processes accessing sensitive Chromium-based browser credential files (e.g., 'Local State', 'Login Data', 'Cookies') followed by suspicious outbound network connections. This pattern is characteristic of credential-stealing malware (infostealers) like Amatera, Lumma, and Remus.
Detects ERAAgent.exe (ESET Remote Administrator Agent) interacting with suspicious named pipes (e.g., mojo, spoolss) and attempts to extract credentials from command line parameters, indicating potential credential dumping or lateral movement techniques using the agent process.
This rule detects suspicious activity involving common web browser credential files (Cookies, Login Data) being read, created, modified, or renamed by processes associated with iCloud synchronization paths on macOS. This behavior is indicative of potentially malicious processes attempting to exfiltrate browser-stored session information or credentials.
Detects instances where 'ERAAgent.exe', part of the ESET Remote Administrator agent, loads the 'dpapi.dll' library from a location outside of standard Windows System directories (System32 or SysWOW64). Furthermore, the rule flags this behavior if the loaded 'dpapi.dll' file is either unsigned or contains an untrusted digital signature, which may indicate a malicious DLL side-loading or masquerading attempt to access protected system credentials.
Detects instances where 'ERAAgent.exe', part of the ESET Remote Administrator agent, loads the 'dpapi.dll' library from a location outside of standard Windows System directories (System32 or SysWOW64). Furthermore, the rule flags this behavior if the loaded 'dpapi.dll' file is either unsigned or contains an untrusted digital signature, which may indicate a malicious DLL side-loading or masquerading attempt to access protected system credentials.
Detects TWINLOOT's fake lock screen credential harvesting technique, where the implant creates a window using highly unique class names (launcher_black_screen_31337, launcher_fake_lockscreen_view) to simulate a Windows lock screen and then calls GetUserNameExW to capture the logged-on user's credentials without validation, feeding harvested credentials into subsequent lateral movement.
Page 61 of 206