Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,438
11,829
5,872
5,150
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects privileged Active Directory enumeration seen on the wire by Corelight, filtered to source hosts that don't appear in the Cortex endpoint inventory. It reads ldap_search records from corelight_zeek_raw, tiers them by the LDAP filter (CRITICAL for credential-attribute and DCSync hunting, HIGH for Tier Zero, Kerberoast, delegation, and UAC-bitmask targeting, MEDIUM for broad group, computer, and GPO enumeration), then joins the source address against endpoints and keeps only the queries whose id_orig_h has no matching managed agent
This rule detects potentially unauthorized processes loading sensitive Windows authentication-related DLLs, specifically those associated with Microsoft Entra ID (formerly Azure AD) and Windows Hello functionality. By filtering against a list of known, legitimate processes, the rule identifies non-Microsoft signed processes that may be attempting to interact with authentication modules, which is a common pattern in credential theft or token manipulation attacks.
This rule detects a potential credential exfiltration attempt following the launch of a terminal (cmd.exe, powershell.exe, bash, zsh, sh) by common IDE processes (Code.exe, Cursor.exe, Antigravity.exe). It monitors for sensitive configuration or credential files (such as .env, .aws/credentials, or .config/gh) being accessed within two minutes of a terminal process being spawned by the development environment.
Detects deletion, modification, or renaming of the Chrome 'passkey_enclave_state' file by a process other than Chrome. This file contains sensitive wrapped identity, User Verification (UV) private keys, and security domain secrets. Unauthorized access or deletion of this file is indicative of an attempt to force Chrome to re-onboard the device, which may expose key material during the re-registration flow.
Slack Anomalous Activity
Cortex XDR
This rule detects anomalous activity reported by Slack's internal anomaly detection system. This includes events such as impossible travel, new device access, suspicious IP changes, and other behavioral anomalies that Slack identifies. The rule extracts relevant user and context information for further investigation.
Detects anomalous certificate issuance via Active Directory Certificate Services (AD CS) where a machine-template certificate is issued to a non-computer requester, but the issued certificate's Subject Alternative Name contains a dNSHostName identifier associated with a Domain Controller. This pattern matches the exploitation of the 'CertiGhost' vulnerability (CVE-2026-54121), which allows unauthorized entities to obtain certificates masquerading as Domain Controllers for potential Kerberos authentication abuse.
Detects Active Directory Certificate Services (AD CS) certificate request or issuance events where the request attributes contain 'cdc=' or 'rmd=' parameters. These parameters are indicative of the CertiGhost (CVE-2026-54121) exploit, where an attacker coerces the Certificate Authority to interact with an attacker-controlled LDAP or LSA listener by abusing chase-abuse flows during the certificate request process.
Detects possible kernel-level WFP redirection of outbound HTTP connections to an unexpected local loopback proxy port while the original destination host header is retained, consistent with Phantom Mantis G12/G13 network redirection.
This rule detects potential credential abuse by monitoring for a burst of GCP access or ID token generation requests by a single user across five or more distinct resource targets within a single project. Such behavior is often indicative of an adversary enumerating resources or performing reconnaissance to identify reachable services or systems after successfully assuming a principal's identity.
Detects the use of netsh.exe to export Wi-Fi profiles with clear-text keys using output redirection or piping. This behavior is indicative of automated credential harvesting, such as that observed in the CaptiveCrunch campaign, while filtering out legitimate interactive usage and known remote support tools.
Detects in-process LDAP enumeration of Active Directory through the .NET System.DirectoryServices classes, the [adsisearcher] type accelerator and DirectorySearcher, captured from PowerShell ScriptBlock logging in action_evtlog_message. Severity is assigned from the LDAP filter and requested attributes. CRITICAL covers queries after credential-bearing attributes (LAPS, gMSA, sIDHistory, GPP/SYSVOL paths) or DCSync replication rights. HIGH covers known attack-technique targeting: Tier Zero enumeration via adminCount, SPN enumeration for Kerberoasting, delegation attributes, and the UAC bitmask filters used for AS-REP roasting and unconstrained delegation. MEDIUM covers broad estate enumeration across groups, computers, GPOs, and OUs. Command-line context (suspicious parent process, encoded or hidden execution) is surfaced as separate fields for triage rather than folded into the score.
This rule detects a potential credential exfiltration attempt following the launch of a terminal (cmd.exe, powershell.exe, bash, zsh, sh) by common IDE processes (Code.exe, Cursor.exe, Antigravity.exe). It monitors for sensitive configuration or credential files (such as .env, .aws/credentials, or .config/gh) being accessed within two minutes of a terminal process being spawned by the development environment.
This query intends to detect potentially malicious VPN login attempts by categorizing them into either password spray, or brute force / password stuffing attempts. Detection is fully tunable to your environment and observed baseline user behavior.
Detects the process st.exe (identified as StealC / TrojanPSW:Win32/StealC) executing and subsequently accessing well-known browser credential store artifacts (Login Data, Cookies, key4.db, logins.json, Local State, Web Data) used to harvest stored passwords and session data from browsers.
Detects process execution events involving database-related commands that may indicate credential tampering or illicit database backups, often associated with database credential theft or exfiltration attempts.
Detects unauthorized credential validation attempts on macOS using the 'dscl -authonly' command. The rule identifies instances where suspicious interpreter processes (like bash, zsh, python, or curl) or their derivatives attempt to validate credentials via the Directory Service Command Line tool, while excluding known legitimate system and management processes.
Detects the download, file creation, or execution of known NirSoft credential and browser harvesting utilities (ChromePass, WebBrowserBookmarksView, Network Password Recovery, LastActivityView) from non-standard directories or identified malicious actor infrastructure.
Detects unauthorized file system access to sensitive Gitea configuration files (app.ini) or internal directories (custom/conf, data/tmp) by the gitea/git service account. This pattern is indicative of post-exploitation credential or secret harvesting following remote code execution vulnerabilities, such as the diffpatch git hook RCE (CVE-2026-60004).
Detects multiple stages of the ChocoShell credential and token theft framework, including SYSTEM token impersonation for DPAPI key access, VSS shadow copy abuse to extract browser databases, malicious use of browser remote debugging ports (CDP) for cookie exfiltration, and unauthorized access to browser profile files or Token Broker cache (.tbres) files.
Detects process execution events involving database-related commands that may indicate credential tampering or illicit database backups, often associated with database credential theft or exfiltration attempts.
Detects potential password spraying or brute force activity against Entra ID by monitoring for a high number of failed authentication attempts from a single IP address targeting multiple unique user accounts within a 15-minute window.
Page 66 of 206