Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects the second-stage payload of the ChainDrop/Mini Shai-Hulud npm supply chain worm, specifically targeting GitHub Actions runner environments. The rule identifies obfuscated Bun-bundled CommonJS credential-stealing scripts (math_init.js) designed to harvest secrets from the Runner.Worker process memory and communicate with C2 infrastructure via EtherHiding Ethereum contract interaction.
This rule detects instances where a user enters a protected password into an application that has not been configured or registered for SSO (Single Sign-On). It achieves this by identifying 'Protected password entered' events and using a join-anti operation to filter out sessions where an 'SSO_PASSWORD_USED' event was previously recorded for the same user and domain.
This rule detects unauthorized access to the Google Chrome LevelDB sync data files. These files contain sensitive information, including synced passwords, and are often targeted by credential-stealing malware. The rule excludes known legitimate Chrome processes to minimize noise, alerting when an unknown or suspicious process interacts with this specific directory structure.
This rule detects potential Pass-the-Hash (PtH) lateral movement by identifying administrative accounts performing NTLM network logons across multiple domain controllers within a 15-minute window. To reduce false positives, the rule excludes authentication events where there is concurrent evidence of interactive (Type 2/10) or Kerberos-based authentication on those same hosts, which helps isolate suspicious non-Kerberos administrative activity.
Detects anomalous session activity where a single authentication session ID is associated with multiple IP addresses and multiple distinct countries within a 20-minute window. This behavior is indicative of session hijacking, such as an Adversary-in-the-Middle (AiTM) attack, where a session token is stolen and reused by an attacker from a different location.
Detects anomalous session activity where a single authentication session ID is associated with multiple IP addresses and multiple distinct countries within a 20-minute window. This behavior is indicative of session hijacking, such as an Adversary-in-the-Middle (AiTM) attack, where a session token is stolen and reused by an attacker from a different location.
Detects in-process LDAP enumeration of Active Directory through the .NET System.DirectoryServices classes, the [adsisearcher] type accelerator and DirectorySearcher, captured from PowerShell ScriptBlock logging in action_evtlog_message. Severity is assigned from the LDAP filter and requested attributes. CRITICAL covers queries after credential-bearing attributes (LAPS, gMSA, sIDHistory, GPP/SYSVOL paths) or DCSync replication rights. HIGH covers known attack-technique targeting: Tier Zero enumeration via adminCount, SPN enumeration for Kerberoasting, delegation attributes, and the UAC bitmask filters used for AS-REP roasting and unconstrained delegation. MEDIUM covers broad estate enumeration across groups, computers, GPOs, and OUs. Command-line context (suspicious parent process, encoded or hidden execution) is surfaced as separate fields for triage rather than folded into the score.
Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.
This rule detects PowerShell execution patterns indicative of fileless information stealer activity. It searches for specific command-line flags often associated with obfuscated or hidden script execution (e.g., -EncodedCommand, -nop -w hidden, IEX) combined with attempts to access or target sensitive files and tokens (e.g., Cookies, Login Data, msal.cache, AAD.BrokerPlugin) common in Microsoft 365 and browser-based credential theft.
Detects the execution of FTK Imager.exe followed by the creation of the Active Directory database (NTDS.dit) and at least one critical Windows registry hive file (SAM, SYSTEM, or SECURITY) in the user's Downloads folder within a 30-minute timeframe. This pattern is indicative of potential credential theft or offline password cracking attempts using forensic imaging utilities.
This rule detects unauthorized access to the Google Chrome LevelDB sync data files. These files contain sensitive information, including synced passwords, and are often targeted by credential-stealing malware. The rule excludes known legitimate Chrome processes to minimize noise, alerting when an unknown or suspicious process interacts with this specific directory structure.
Detects unauthorized access, creation, modification, or deletion of the 'passkey_enclave_state' file within the Google Chrome user data directory by processes other than 'chrome.exe'. This file contains sensitive cryptographic material related to Chrome's synced passkey cloud authenticator, and non-browser process interaction with it is indicative of potential credential theft or passkey exfiltration (e.g., 'Golden/Silver Pass-ta-key' attacks).
Detects modifications to the 'msDS-KeyCredentialLink' attribute on user or computer objects within Active Directory. This attribute is targeted in 'Shadow Credentials' attacks (e.g., using tools like Whisker, pyWhisker, or DSInternals) to add an attacker-controlled public key, allowing for PKINIT-based authentication as the victim account without knowing the password.
Possible O365 credential exfil via HTTP PUT to attacker-controlled S3 bucket
Certighost
KQL
These credentials are used to perform DCSync or other activities, resulting in logon events from domain controller computer account originating from a non-domain controller IP address.
Detects non-browser, non-password-manager processes accessing browser process memory (potential in-memory cookie theft), copying browser credential/cookie database files (Login Data, Cookies, Local State, key4.db, logins.json), or enumerating stored Wi-Fi profile keys via netsh wlan show profile key=clear - behaviors associated with CornFlake RAT credential theft and Wi-Fi credential harvesting used in the CaptiveCrunch campaign.
Detects the second-stage payload of the ChainDrop/Mini Shai-Hulud npm supply chain worm, specifically targeting GitHub Actions runner environments. The rule identifies obfuscated Bun-bundled CommonJS credential-stealing scripts (math_init.js) designed to harvest secrets from the Runner.Worker process memory and communicate with C2 infrastructure via EtherHiding Ethereum contract interaction.
Detects the second-stage payload of the ChainDrop/Mini Shai-Hulud npm supply chain worm, specifically targeting GitHub Actions runner environments. The rule identifies obfuscated Bun-bundled CommonJS credential-stealing scripts (math_init.js) designed to harvest secrets from the Runner.Worker process memory and communicate with C2 infrastructure via EtherHiding Ethereum contract interaction.
Detects privileged Active Directory enumeration seen on the wire by Corelight, filtered to source hosts that don't appear in the Cortex endpoint inventory. It reads ldap_search records from corelight_zeek_raw, tiers them by the LDAP filter (CRITICAL for credential-attribute and DCSync hunting, HIGH for Tier Zero, Kerberoast, delegation, and UAC-bitmask targeting, MEDIUM for broad group, computer, and GPO enumeration), then joins the source address against endpoints and keeps only the queries whose id_orig_h has no matching managed agent
This rule detects potentially unauthorized processes loading sensitive Windows authentication-related DLLs, specifically those associated with Microsoft Entra ID (formerly Azure AD) and Windows Hello functionality. By filtering against a list of known, legitimate processes, the rule identifies non-Microsoft signed processes that may be attempting to interact with authentication modules, which is a common pattern in credential theft or token manipulation attacks.
This query identifies a device being added to an Entra ID account following a suspected successful device code phish attempt as evidenced by the sign in method displaying "deviceCodeFlow". Attackers have been known to register a new device shortly after compromising a user account to establish persistence in the form of Primary Refresh Tokens (PRTs) generated by the attacker-controlled device.
Page 65 of 206