Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects read, creation, or modification events involving common cryptocurrency wallet files (e.g., wallet.dat) or directories associated with wallet applications (Exodus, Electrum, Ledger Live) located within user application support directories. This behavior is indicative of credential access attempts where an adversary is trying to steal private keys or wallet data.
Detects the use of the security command-line tool with the 'unlock-keychain' argument and the '-p' flag, which indicates an attempt to programmatically unlock a keychain, potentially using a supplied password.
This rule detects unauthorized read, creation, modification, or renaming activity involving sensitive browser files (Login Data, Cookies, Web Data) on macOS. Adversaries often target these files to extract saved credentials, cookies for session hijacking, or browsing history.
Detects instances where processes other than common web browsers (e.g., Chrome, Edge, Firefox) access sensitive browser data files (such as login data, cookies, or history) located in standard browser profile directories. This behavior is indicative of credential dumping or unauthorized data collection from local web browser storage.
Detects access, creation, or modification of sensitive browser files (Cookies, Login Data, Local State) associated with Google Chrome or Microsoft Edge. The rule specifically flags when these files are interacted with within standard user directories or when they are copied to known browser backup folders, a common behavior during credential theft or data staging.
This rule detects potential Active Directory Certificate Services (ADCS) ESC17 abuse by monitoring for certificate requests that contain a Subject Alternative Name (SAN) or Common Name (CN) matching trusted external domains such as 'login.microsoftonline.com'. It also monitors for Certipy command-line activity targeting insecure web server templates or attempting ESC17-specific maneuvers, which indicates an attempt to forge certificates for domain impersonation or unauthorized authentication.
This rule detects processes being executed that contain 'nacos' and 'token.secret.key' within their command-line arguments. This pattern is indicative of potential attempts to leverage or identify the default JWT secret key for an Apache Nacos deployment, which could allow an attacker to forge authentication tokens and gain unauthorized access.
This rule detects successful sign-in events originating from IP addresses that have previously demonstrated a password-spraying pattern (multiple failed sign-ins across distinct accounts within a two-hour window). To reduce noise, it excludes successful logins originating from 'known' Autonomous System Numbers (ASNs) where at least 10 distinct users have historically authenticated successfully. The detection further filters for sessions lacking managed device identifiers and allows for manual exclusion of specific applications, IP addresses, or geographic locations.
Detects Python scripts or processes accessing browser 'Local State' files and subsequently invoking decryption routines like DPAPI's CryptUnprotectData or NSS's PK11SDR_Decrypt. This behavior is indicative of credential theft activity where malware, such as BusySnake Stealer, attempts to decrypt stored browser credentials for exfiltration.
This rule detects the execution of the Mimikatz credential dumping tool by monitoring for specific process names or command-line arguments, including the use of 'sekurlsa' modules to harvest credentials from memory. Mimikatz is widely used by adversaries to perform credential theft, including dumping passwords, hashes, and Kerberos tickets from memory.
Detects the usage of the Google Cloud IAM Credentials API to generate OAuth access tokens, OIDC ID tokens, sign JWTs, or sign blobs as a service account. This behavior indicates an identity assuming a service account's permissions, a common technique for privilege escalation or lateral movement in GCP environments.
Detects failed authentication attempts using the BAV2ROPC user agent (Azure CLI / legacy OAuth2 ROPC token requests) in Microsoft 365 Unified Audit Logs. BAV2ROPC bypasses MFA by authenticating directly to the /token endpoint. Error codes 50053 (account lockout), 50126 (invalid credentials), and 50034 (user not found) are characteristic of password spraying activity. Observed in the LSHIY LLC password spray campaign (June 2026).
This rule detects the use of the OAuth 2.0 Device Code Authorization flow directed towards 'microsoft.com/devicelogin'. This authentication method is frequently abused by attackers in phishing campaigns to hijack device-based user sessions by tricking victims into entering a device code on a malicious site, effectively bypassing traditional password-based authentication.
Detects unauthorized access attempts to session files and account credentials stored locally by Discord, Telegram, and Steam applications, a behavior consistent with the CastleStealer malware.
This rule detects the execution of known NirSoft credential recovery utilities, such as WebBrowserPassView, ChromePass, and others, when they are located within a specific 'music/mimik/' directory structure, which is indicative of credential harvesting activities staged by an adversary.
This rule detects a multi-stage attack chain originating from OAuth device code phishing. It tracks the sequence of events starting from device code authentication, followed by the registration of a new device or Primary Refresh Token (PRT) manipulation, potential password resets, and the creation of malicious inbox rules (e.g., auto-forwarding). The rule correlates these events within a 1-hour window to identify malicious intent, with critical alerts triggered if persistence mechanisms survive a password reset.
Detects unauthorized access to sensitive credential files, such as credentials.json or .env, through HTTP GET requests, or the creation/staging of a credentials file at /tmp/creds.json, which may indicate attempts to exfiltrate or steal credentials from the local system.
Detects the presence of specific Microsoft Entra (formerly Azure AD) authentication session cookies (ESTSAUTH, ESTSAUTHPERSISTENT, ESTSAUTHLIGHT) in web proxy traffic. This activity is indicative of session cookie theft and potential replay attacks (Pass-the-Cookie) where an adversary attempts to authenticate to Microsoft services using stolen session material from an unauthorized or non-enrolled device.
Detects access or creation of sensitive browser-related files such as cookies, login data, and preferences within identified backup directories for Google Chrome and Microsoft Edge. This activity is often associated with credential theft or data staging for later exfiltration.
Detects attempts to retrieve Azure Container Registry (ACR) credentials, either by executing specific Azure CLI commands on a host or by initiating the Microsoft.ContainerRegistry/registries/listCredentials/action via Azure Activity Logs. Such activities may indicate an adversary attempting to gain unauthorized access to container registries.
Detects the execution of command-line arguments associated with the 'FortiEndpoint_Patch.exe' binary, which is used by the EKZ Stealer malware to perform credential harvesting operations such as listing, searching, viewing, exporting, or labeling sensitive data.
Page 71 of 206