Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects TrymeLocker modifying the Image File Execution Options (IFEO) for accessibility binaries to establish a login screen backdoor with SYSTEM privileges.
Detects unauthorized processes attempting to access Firefox credential storage files (key4.db, logins.json) or loading the NSS cryptographic library (nss3.dll) commonly used by Firefox for decryption, which is indicative of credential harvesting.
This rule detects suspicious Google OAuth authorization requests directed at accounts.google.com that utilize a local redirect URI (http://localhost) and are missing mandatory security parameters such as code_challenge, state, and login_hint. These characteristics are often associated with OAuth-based phishing or credential theft campaigns where an adversary attempts to intercept authorization codes.
This rule detects processes accessing sensitive browser credential files ('passwords.json' or 'cookies.json') located in common browser profile output directories. Accessing these files is a common technique used by malware and adversaries to steal stored credentials from web browsers.
Detects a sequence of suspicious activities characteristic of information-stealing malware (e.g., Vidar/SnappyClient). The rule correlates browser credential access (Login Data/Cookies), screen capturing (GDI API calls), and keylogging (SetWindowsHookEx) with subsequent archive staging activities (compression of sensitive data in temp folders) within a one-hour window.
Detects the EKZ Stealer malware masquerading as a legitimate Fortinet update process (FortiEndpoint_Patch.exe). The rule monitors for the execution of this specific filename or hash, identifies suspicious command-line arguments (list, search, view, label, export) indicating credential theft activities, and alerts on the creation of the binary and subsequent log files within the ProgramData directory.
Detects credential harvesting behavior by non-browser processes attempting to access browser credential storage (Login Data/Local State files) and identifies execution of the masquerading binary 'FortiEndpoint_Patch.exe' and the creation of the 'log.txt' artifact in C:\ProgramData used by the EKZ Stealer.
This rule detects potential 'impossible travel' scenarios within Azure AD sign-in logs. It identifies users who successfully sign in to Office 365 from two geographically distant IP addresses within a one-hour window, suggesting a potential compromise or an attempt to bypass security controls.
This rule detects potential credential harvesting and sensitive data collection activities on macOS by monitoring for access to keychain databases, browser data files (cookies, logins), and shell history files. It looks for both direct file access and the use of the 'security' utility to dump keychain information.
This rule monitors for potential lateral phishing activity within an organization by identifying internal accounts sending high volumes of emails, correlating this with MailItemsAccessed audit events from unexpected IPs, and detecting OAuth token abuse patterns (such as granting consent or adding credentials) within the Exchange Online environment.
Detects unauthorized attempts to access or extract Redis credentials from the Argo CD repo-server process. The detection identifies suspicious command-line activity where environment variables are enumerated (via env or printenv) or sensitive configuration files (/etc/argocd) are accessed by the repo-server process or its children. This behavior is indicative of an attacker attempting to exploit unauthenticated gRPC vulnerabilities to steal credentials for cache poisoning or further lateral movement within a containerized environment.
Detects the use of the klist.exe utility with suspicious subcommands ('sessions', '-li', 'get', 'purge') to inspect, retrieve, or clear cached Kerberos tickets, which is indicative of credential discovery or post-exploitation activity.
Detects an abnormally high volume of Kerberos TGS (Ticket Granting Service) requests encrypted with RC4 (0x17) from a single source IP. This behavior is indicative of Kerberoasting, an attack where an adversary attempts to extract service account passwords from requested TGS tickets.
This rule detects unauthorized processes attempting to open a handle to the Local Security Authority Subsystem Service (lsass.exe) with PROCESS_VM_READ access rights. Such access is often associated with credential dumping techniques, particularly those utilizing direct syscalls to evade EDR and kernel-level monitoring by bypassing standard Windows API-based detection mechanisms.
This rule detects potential Kerberoasting activity by identifying an unusual number of Kerberos service ticket requests (Event ID 4769) for service principal names (SPNs) ending with '$' from a single client address within an hour. A high count (over 10) is flagged as 'High' suspicion, while a count between 5 and 10 is flagged as 'Medium'. This behavior is indicative of an attacker attempting to obtain service ticket hashes for offline cracking.
This rule detects an unusually high number of NTLM logon attempts (more than 3 within a 10-minute window) from a single IP address to various accounts or workstations. This behavior is indicative of a brute-force attack or password guessing attempt against network services, particularly when the logon type is network (3) or remote interactive (10) and not from localhost.
Detects suspicious activity related to OAuth2PermissionGrant operations, specifically looking for a high volume of successful consent grants by a single user within a short timeframe. This could indicate an attacker attempting to gain broad access to resources by granting permissions to a malicious OAuth application.
Detects the use of the 'diagnose sniffer packet' command on FortiOS, or evidence of the FortigateSniffer tool (associated with past FortiGate vulnerabilities). This behavior is indicative of unauthorized packet capture and potential credential sniffing on network infrastructure devices.
Detects the post-exploitation behavior associated with EKZ Stealer, specifically the creation of a credential-containing log file in ProgramData, followed by the rapid deletion of the file and the source stealer binary. This behavior is indicative of anti-forensic cleanup steps often used to conceal credential harvesting activities.
This rule detects device registration activities in Entra ID using the specific AppId associated with the DCL broker, which is commonly leveraged to register unauthorized virtual devices. This registration process is often used by adversaries to facilitate Primary Refresh Token (PRT) acquisition, enabling persistent access or bypassing conditional access controls.
Detects unauthorized processes attempting to access sensitive browser data files (Login Data, Cookies, Web Data) that are typically used by web browsers to store credentials and session information. The rule filters out known legitimate browser processes, flagging potential credential theft or session hijacking activity.
Page 73 of 206