Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects attempts by non-browser processes to access sensitive Chromium-based browser files including Login Data, Cookies, and Web Data. This behavior is indicative of credential dumping or session cookie theft where unauthorized software attempts to extract browser-stored secrets.
Detects instances where a process other than the authorized password manager application (e.g., 1Password, Bitwarden, KeePass) attempts to create, modify, rename, or read sensitive database files associated with these password managers. This behavior may indicate an attempt to exfiltrate or compromise stored credentials.
Detects Cisco device configuration lines containing weakly protected or plaintext credentials (Type 0 plaintext, Type 4 broken SHA-256, Type 7 Vigenere-cipher passwords) captured in syslog/config backup feeds. These weak hash types are trivially reversible and, once a router config is exfiltrated (e.g., via SNMP/TFTP abuse), allow rapid credential recovery and lateral movement.
This rule monitors container logs for attempts to access the Azure Instance Metadata Service (IMDS) via the 169.254.169.254 endpoint to request OAuth tokens or access Azure Key Vault secrets. Such activity within a containerized environment is often indicative of credential theft or discovery attempts by an adversary attempting to escalate privileges using the container's managed identity.
This rule monitors for processes making requests to cloud instance metadata services (GCP) or accessing sensitive secrets and parameters via AWS CloudTrail. Such activity may indicate an attacker attempting to enumerate instance identities, retrieve temporary security credentials, or access managed configuration secrets.
Detects the JC-46 AsyncRAT technique chain where the malware opens winlogon.exe's process token, duplicates it into an impersonation token, calls ImpersonateLoggedOnUser, enables SE_DEBUG_NAME via AdjustTokenPrivileges to reach SYSTEM context, then uses CNG (NCryptOpenStorageProvider/NCryptOpenKey/NCryptDecrypt) and BCrypt AES-GCM (BCryptOpenAlgorithmProvider) APIs to unwrap Chromium v96+ App-Bound Encryption keys.
Detects the JC-46 AsyncRAT technique chain where the malware opens winlogon.exe's process token, duplicates it into an impersonation token, calls ImpersonateLoggedOnUser, enables SE_DEBUG_NAME via AdjustTokenPrivileges to reach SYSTEM context, then uses CNG (NCryptOpenStorageProvider/NCryptOpenKey/NCryptDecrypt) and BCrypt AES-GCM (BCryptOpenAlgorithmProvider) APIs to unwrap Chromium v96+ App-Bound Encryption keys.
Detects unauthorized processes attempting to access sensitive credential database files (Login Data, key4.db, logins.json) used by Chromium-based browsers or Mozilla Firefox. This behavior is indicative of credential theft attempts, where malicious actors seek to extract saved passwords and cookies from the browser's local storage.
Detects suspicious execution of tools or command lines associated with DPAPI domain backup key extraction, including mimikatz, SharpDPAPI, lsadump::backupkeys, and related backupkey commands. This behavior may indicate an attempt to obtain the domain DPAPI backup key from a Domain Controller, enabling decryption of DPAPI-protected secrets across the domain.
Detects suspicious use of the OAuth 2.0 device code authentication flow. The rule identifies potential token harvesting and phishing attempts by flagging device code sign-ins that originate from unusual user agents, unknown IP addresses or ASNs, unrecognized applications, or for users who have not previously utilized device code authentication. Legitimate, first-party applications like Azure CLI and Azure PowerShell are explicitly excluded to minimize noise.
Detects access to the Windows DPAPI master key storage directory located at '\Microsoft\Protect\' by processes other than standard system components (lsass.exe, svchost.exe, dllhost.exe). Accessing these files is a common technique used by adversaries to decrypt sensitive credentials stored on the system.
Detects access to the Windows DPAPI master key storage directory located at '\Microsoft\Protect\' by processes other than standard system components (lsass.exe, svchost.exe, dllhost.exe). Accessing these files is a common technique used by adversaries to decrypt sensitive credentials stored on the system.
Detects a single host rapidly initiating outbound Telnet (port 23) or SSH (port 22) connection attempts against a large number of distinct remote IP addresses in a short window. This behavior is indicative of bot-agent scanners, such as those associated with IoT botnets, attempting to propagate by performing brute-force login attempts using default credential pairs.
Detects NirSoft-based credential harvesting toolkit binaries staged in user profile path csidl_profile\music\mimik\pass\, used to extract browser, VNC, email, Wi-Fi, and Credential Manager secrets
Detects various stages of the Armored Likho APT campaign using the BusySnake stealer, including lure archive delivery, NSIS droppers, LNK shortcut abuse, PowerShell-based staging, VBScript persistence, scheduled task creation, reverse SSH tunneling, and exfiltration of browser and communication artifacts.
This rule detects file creation, renaming, or modification events targeting files associated with cryptocurrency wallets, such as wallet.dat or files containing the string 'keystore'. Accessing these files is a common technique used by malware or malicious actors to steal cryptocurrency credentials and private keys.
Detects unauthorized processes attempting to access sensitive credential database files (Login Data, key4.db, logins.json) used by Chromium-based browsers or Mozilla Firefox. This behavior is indicative of credential theft attempts, where malicious actors seek to extract saved passwords and cookies from the browser's local storage.
Detects process command lines using curl to query the Azure Instance Metadata Service (IMDS) endpoint (169.254.169.254) for OAuth tokens. This behavior is indicative of an attacker attempting to leverage an Azure Managed Identity associated with a compromised virtual machine to obtain temporary security tokens for unauthorized access to other Azure resources.
Detects Node.js processes executing with command-line arguments containing potential GitHub personal access tokens (PAT) or secrets while simultaneously initiating a network connection to the GitHub API. This behavior is indicative of potential credential abuse or automated exfiltration of sensitive tokens.
Detects the use of the 'dscl' utility on macOS with the '-authonly' flag. This command is often used by adversaries or for unauthorized scripts to verify credentials against the local directory service without requiring a full login session, which is a common indicator of credential testing or brute-force attempts.
Detects file access or read operations performed against known password manager database files (1Password, Bitwarden). This activity may indicate an attempt to acquire credentials from local storage.
Page 69 of 206