Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects the EKZ Stealer malware (masquerading as 'FortiEndpoint_Patch.exe') attempting to access sensitive web browser files ('Login Data' and 'Local State') used to store credentials, and subsequently writing stolen information to 'C:\ProgramData\log.txt'.
Detects the presence and execution of 'FortiEndpoint_Patch.exe' from non-standard locations (C:\ProgramData) used for masquerading, or the invocation of the ElevationKatz command-line tool (runhlp.exe --v20-decrypt) used to perform credential decryption.
Detects the modification of the 'UseLogonCredential' registry value within the WDigest configuration key to 1. Enabling this value forces Windows to cache user credentials in plaintext in the memory of the Local Security Authority Subsystem Service (LSASS), which is a common post-exploitation step to facilitate credential harvesting using tools like Mimikatz.
This rule detects an unusually high number of NTLM logon attempts (more than 3 within a 10-minute window) from a single IP address to various accounts or workstations. This behavior is indicative of a brute-force attack or password guessing attempt against network services, particularly when the logon type is network (3) or remote interactive (10) and not from localhost.
Detects execution of Mimikatz or usage of common tools like Procdump to dump LSASS memory. The rule monitors for characteristic command-line arguments, renamed binary names associated with Mimikatz, and the extraction of sensitive credentials to output files.
This rule detects potentially malicious command-line execution patterns aimed at harvesting sensitive credentials. It monitors for the access or searching of configuration files (e.g., AWS, .env, or Github tokens) and the dumping of environment variables that likely contain API keys or secrets, specifically targeting services like AWS, Anthropic, and GitHub.
This rule detects non-Mozilla processes that systematically access sensitive Firefox browser files such as logins.json, key3.db, key4.db, and cookies.sqlite. Repeated access by processes not associated with the Mozilla Corporation or the Firefox browser suite is indicative of credential harvesting attempts by malicious software.
Detects unauthorized access, copy, or read operations against Chromium-based browser cookie database files by processes other than standard browsers. This behavior is indicative of session hijacking, a technique observed in malware like TONResolver and Millenium RAT to extract authentication tokens for subsequent adversary-in-the-middle or session theft attacks.
This rule detects potential credential harvesting activities by monitoring for suspicious environment variable enumeration or unauthorized access to sensitive credential and configuration files (such as AWS credentials and .env files) by common command-line utilities. It is designed to identify post-compromise reconnaissance where an adversary attempts to extract cloud provider or AI API keys.
Detects unauthorized or suspicious processes reading sensitive credential files (AWS, .env, etc.) and subsequently initiating a successful network connection to an external destination within a 5-minute window. This behavior is a common indicator of credential exfiltration.
This rule detects shell commands (bash, sh, zsh) initiated by AI-agent or development-related processes (e.g., Python, Claude Desktop, openclaw) that target sensitive macOS paths associated with credentials, SSH keys, crypto wallets, and browser cookies, a technique characteristic of the Atomic Stealer (AMOS) malware.
This rule detects various methods used to dump the memory of the Local Security Authority Subsystem Service (LSASS) process to extract credentials. It monitors for suspicious Process Access (EventCode 10) with sensitive access masks, as well as Process Creation (EventCode 1) and Image Load (EventCode 7) events associated with known credential dumping tools like Mimikatz and legitimate system tools misused for dumping memory such as Procdump and comsvcs.dll.
Detects unauthorized processes (Node.js or Python) attempting to read sensitive browser credential files or access browser profile directories, often indicative of credential theft malware such as BeaverTail or InvisibleFerret.
Detects instances where scripting engines (Python or Node.js) access known SSH private key files and subsequently initiate a successful network connection to a non-private IP address within a 60-second window. This behavior is indicative of potential credential exfiltration or unauthorized remote access.
Detects potential identity pivoting by correlating signs of developer workstation compromise (e.g., shell spawning from IDE/node processes) with subsequent anomalous cloud console or API access from the same or associated identity within a short timeframe. This rule monitors both Azure Sign-in logs and AWS CloudTrail activity for suspicious patterns following endpoint indicators.
Detects the execution of known Kerberoasting tools or commands that indicate an attempt to request Kerberos service tickets for offline cracking. This activity is a core component of the Kerberoasting attack technique.
Detects unauthorized non-browser processes accessing Chrome Local State, Cookies, or Login Data files. This activity is indicative of credential harvesting by infostealers, such as the Glove Stealer/Yuta campaign, attempting to bypass App-Bound Encryption (ABE) by accessing browser configuration and data stores.
Detects a sequence of events where a user performs a network logon (Event ID 4624, Logon Type 3) followed by a successful Directory Replication Service (DRS) request (Event ID 4662, Access Mask 0x100) on a Domain Controller within a one-hour window. This pattern is indicative of potential lateral movement followed by credential dumping via DCSync, often associated with tools like Mimikatz.
Detects Microsoft Graph API enumeration of privileged directory endpoints using a token with only User.Read scope and password-only authentication (amr: pwd). This activity is consistent with the exploitation of CVE-2025-0309, often associated with tooling like AzureHound/roadtx, which abuses hidden Conditional Access exclusion policies.
This rule detects suspicious activity related to the Netlogon service or the LSASS process. It triggers on Netlogon service events (5827, 5828, 5829) which may indicate insecure channel usage or service issues often associated with exploitation, and on Sysmon Event ID 1 where a process is spawned by lsass.exe under the SYSTEM user, a behavior frequently seen during credential dumping or privilege escalation attempts.
Detects the use of legitimate Windows system utilities (ntdsutil.exe, vssadmin.exe, esentutl.exe) to interact with the Active Directory database file (ntds.dit). This behavior is commonly associated with offline credential harvesting, where an attacker attempts to create a copy of the database to extract hashes offline.
Page 78 of 206