Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
This rule detects a multi-stage attack chain originating from OAuth device code phishing. It tracks the sequence of events starting from device code authentication, followed by the registration of a new device or Primary Refresh Token (PRT) manipulation, potential password resets, and the creation of malicious inbox rules (e.g., auto-forwarding). The rule correlates these events within a 1-hour window to identify malicious intent, with critical alerts triggered if persistence mechanisms survive a password reset.
Detects the execution of SharpDPAPI with command-line arguments designed to perform machine-scoped DPAPI masterkey and certificate recovery. This behavior is often associated with credential theft, particularly the extraction of sensitive secrets like ADFS token-signing keys or machine credentials stored in the DPAPI system.
Detects the execution of SniffPass, a known network password recovery tool often used by adversaries to capture passwords from various network protocols (e.g., POP3, IMAP, SMTP, FTP, and HTTP). The rule monitors process execution events for known SniffPass binary names and SHA256 hashes.
Detects outbound web requests to OpenAI, Anthropic, or Google Gemini API endpoints that contain suspected API keys (OpenAI 'sk-proj-', Anthropic 'sk-ant-', or Google 'AIza' prefixes) in the request stream, potentially indicating hardcoded credentials, malicious script activity, or data exfiltration.
This rule detects potential device code phishing attempts by correlating URL click events with sign-in logs using the 'deviceCode' authentication protocol. It specifically looks for successful or failed sign-ins (result types 0, 50074, 50076, 500121) that occur after a user clicks on a URL.
Detects unauthorized processes attempting to access sensitive browser credential files ('Login Data', 'Local State', 'key4.db', 'logins.json') which are typically associated with stored passwords and profile data. The rule specifically excludes common web browsers (Chrome, Edge, Firefox, Brave, Opera) to reduce noise from legitimate browser operations.
This rule monitors process command lines for strings associated with sensitive API keys (e.g., OpenAI, Alibaba, Huawei, Tencent, Aliyun) or seed phrases. It triggers an alert when two or more distinct patterns are identified on the same host, indicating potential credential harvesting or discovery activities.
Detects unauthorized access attempts to MinIO object storage using the default 'minioadmin' credentials. The rule specifically flags attempts to access sensitive files like 'terraform-state' or 'credentials.json' via HTTP GET requests.
This rule detects the execution of processes named 'MiniBrowse' or access attempts to common web browser credential storage files (Google Chrome 'Login Data', Microsoft Edge 'Login Data', and Mozilla Firefox 'logins.json' or 'key4.db'). These patterns are characteristic of browser credential stealing malware or unauthorized data collection tools.
Detects the execution of Mimikatz with command line arguments indicative of credential dumping, specifically DCSync attacks or dumping LSASS memory for passwords. The rule filters out processes signed by Microsoft to reduce noise.
Detects mpr.dll loaded by non-standard processes followed by an SMB (port 445) connection from the same process, consistent with Cavern Manticore's WNetAddConnection2 routine that lazily resolves the API via P/Invoke (bypassing the static import table) and marshals stolen credentials to authenticate to remote network resources.
Detects rapid SMB (port 445) connect/disconnect patterns originating from processes that have loaded mpr.dll. This behavior is indicative of credential spraying tools, such as the Cavern Manticore NetUseBrute module, which utilizes WNetAddConnection2 and WNetCancelConnection2 to cycle through credentials against multiple endpoints.
Detects unauthorized attempts by low-privileged API tokens to access sensitive Argo CD endpoints related to Git repository credentials and project configurations. This rule specifically monitors for exploitation patterns associated with CVE-2025-55190, where tokens with read-only access could retrieve secrets they are not authorized to view.
Detects high-volume password spraying attempts targeting Microsoft 365, originating from the LSHIY LLC IPv6 address space (2a0a:d683::/32). The rule monitors for failed sign-ins using the OAuth ROPC flow via Azure CLI or similar tools, identifying high counts of distinct accounts targeted within a short time frame.
This rule detects a multi-stage attack pattern involving the execution of PowerShell via explorer.exe, followed by subsequent sub-process activity that attempts to access sensitive browser-stored credentials (Login Data or Cookies) or specific cryptocurrency wallet data, combined with a concurrent network connection attempt, indicative of credential exfiltration via a command-and-control (C2) beacon.
Detects file activity (creation, modification, copying, or renaming) within the 'leveldb' directories of popular web browsers (Chrome, Edge, Brave, Opera) and Discord applications by processes other than the legitimate application executables. This behavior is highly indicative of credential theft or data staging, often associated with malware attempting to extract browser session cookies, local storage databases, or stored credentials.
This rule detects potentially malicious access to the Local Security Authority Subsystem Service (LSASS) process (lsass.exe). It correlates events where a process requests sensitive access rights (0x1010 or PROCESS_VM_READ) to LSASS with other activities indicating the presence of Mimikatz or related credential dumping tools (e.g., presence of 'mimikatz' or 'sekurlsa' in process names or command lines).
This rule monitors for a suspicious execution pattern where a browser (Chrome or Edge) is launched with specific command-line flags ('--no-first-run', '--disable-gpu', 'about:blank') by a non-standard parent process, followed shortly by the loading of the 'elevation_service.exe' from 'services.exe' and the loading of 'DPAPI.dll' by the browser process. This sequence is often associated with automated browser credential dumping activities, where attackers attempt to bypass UI requirements or programmatically extract secrets from the browser's credential storage.
Detects instances where command-line arguments contain sensitive patterns such as cloud provider API keys, secret access keys, environment variable files, or cryptographic seed phrases. The rule specifically flags hosts where multiple such suspicious commands are executed, indicating potential reconnaissance or credential theft activity.
This rule detects instances where a user clicks on a URL identified as potentially malicious (phishing-related) and subsequently has a risky sign-in event in Azure AD. The rule correlates URL click events from email with Azure AD sign-in logs, specifically looking for sign-ins marked as risky or originating from suspicious user agents (e.g., specific axios versions). The phishing URLs are identified by keywords such as 'azureapplicationregistration.pages.dev', 'chrnobinson.com', 'workers.dev', '.pages.dev', '.web.core.windows.net', '/oauth2/v2.0/authorize', 'client_id=', and 'scope=openid'.
Detects the use of the 'security' command-line utility to interact with the 'login.keychain-db' file on macOS, which is a common technique used by adversaries to dump credentials.
Page 72 of 206