Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,443
11,831
5,875
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Threat hunting query designed to identify suspicious FortiGate SSL-VPN and administrative authentication activity that may indicate credential abuse following the FortiBleed 2026 credential exposure campaign.
This hunt focuses on post-exposure behavior rather than vulnerability exploitation and combines multiple hunting hypotheses, including:
- Previously unseen user/IP combinations
- Multiple users authenticating from the same source IP
- Single users authenticating from multiple source IPs
- Rapid country changes resembling impossible-travel scenarios
- Administrative account creation or modification
- Firewall and VPN configuration changes
- Potential tunneling or proxy activity associated with post-compromise operations
The objective is to identify unauthorized access resulting from exposed FortiGate administrator credentials or SSL-VPN credentials.
This query is intended as a hunting starting point and should be adapted to local FortiGate log formats, parser mappings, enrichment sources and operational requirements.
This hunt focuses on post-exposure behavior rather than vulnerability exploitation and combines multiple hunting hypotheses, including:
- Previously unseen user/IP combinations
- Multiple users authenticating from the same source IP
- Single users authenticating from multiple source IPs
- Rapid country changes resembling impossible-travel scenarios
- Administrative account creation or modification
- Firewall and VPN configuration changes
- Potential tunneling or proxy activity associated with post-compromise operations
The objective is to identify unauthorized access resulting from exposed FortiGate administrator credentials or SSL-VPN credentials.
This query is intended as a hunting starting point and should be adapted to local FortiGate log formats, parser mappings, enrichment sources and operational requirements.
This rule detects various methods used to copy or access the Active Directory database (NTDS.dit), a common technique used by attackers to dump domain credentials. The rule monitors for the use of ntdsutil with 'ifm' (install from media) arguments, vssadmin to create volume shadow copies of the NTDS file, esentutl directly interacting with the NTDS database path, and common file copy utilities attempting to copy the NTDS.dit file.
This rule detects potential automated reconnaissance or credential harvesting by monitoring for high volumes of LDAP queries targeting sensitive Active Directory attributes. It correlates both LDAP query events and Windows Security Event ID 4662 to identify bulk access to attributes like 'samAccountName', 'userPassword', and 'memberOf'.
Detects Python processes (potentially associated with the ChocoPoC RAT, slogsec, or logcrypt modules) performing file read or access operations against common browser credential store files such as Login Data, Cookies, and Web Data on Windows and macOS systems.
This query detects multiple TTPs associated with the Storm-2561 campaign that uses SEO poisoning to distribute fake VPN clients for credential theft. It looks for known file hashes, a specific code-signing certificate, malicious DLL side-loading and C2 communication patterns.
This rule detects potential Kerberoasting activity by monitoring Windows Event ID 4769 (Kerberos service ticket request). It identifies excessive requests for service tickets using RC4 encryption (0x17) by a single account within a 10-minute window, excluding common service accounts and krbtgt requests.
This rule detects outbound network traffic from an instance or container to the Google Cloud metadata service (metadata.google.internal or 169.254.169.254). Such activity is highly indicative of Server-Side Request Forgery (SSRF) exploitation, where an attacker attempts to retrieve service account credentials or instance metadata from an internal service.
Detects attempts by a Chrome web browser process to create, modify, or rename files associated with sensitive user credentials or application data, such as AWS credentials, browser logins, or environment configuration files. This behavior is indicative of credential theft or staging of sensitive information.
Detects unexpected network connections initiated by the Local Security Authority Subsystem Service (lsass.exe) to the localhost (127.0.0.1) on ports other than standard SMB ports (445 or 139). LSASS should typically only communicate locally via RPC or LPC for authentication services, and anomalous network activity from this process may indicate credential theft attempts, process injection, or unauthorized memory access activities.
Detects HTTP POST requests to known phishing kit endpoints 'panel_track.php' or 'verify_api.php', which are associated with the Montana Empire credential harvesting campaign.
Detects network traffic attempting to access sensitive Windows Registry keys (SAM, SECURITY, LSA Secrets, winlogon DefaultPassword) over the SMB protocol, which is indicative of credential harvesting activities.
Detects the execution of known Kerberoasting tools such as Rubeus and Impacket (GetST, GetTGT, asktgs) or command-line arguments indicative of Kerberoasting, specifically targeting RC4/ETYPE-23 ticket requests that are often used to crack service account passwords offline.
This rule detects suspicious activity related to OpenSSL or certificate manipulation by identifying processes that execute commands containing 'openssl' or 'certificate' keywords. It aggregates these activities by computer and account within one-hour bins and flags if three or more such activities occur, which could indicate credential access attempts or system misconfiguration.
This rule detects potential Kerberoasting attacks by identifying a high number of Kerberos Ticket-Granting Service (TGS) requests (EventID 4769) for Service Principal Names (SPNs) that are encrypted with RC4 (indicated by TicketOptions containing '0x40810000'). A threshold of 15 or more TGS requests from a single IP address for a target user is used to flag suspicious activity.
This rule detects suspicious sign-in attempts to Microsoft services (login.microsoftonline.com, graph.microsoft.com, outlook.office365.com) that occur within 30 minutes of a user clicking on a URL associated with these services. The sign-in is considered suspicious if it originates from a user agent commonly used by automated tools (e.g., axios, curl, python-requests, httpclient, Go-http-client) and is flagged with a 'atRisk' or 'high' risk level by Azure AD. This combination suggests a potential credential compromise following a phishing attempt, where an attacker might be using automated tools to leverage stolen credentials.
Detects when a web browser (Chrome, Edge, Firefox, Brave, Opera) initiates a process that is not another instance of itself. This could indicate a drive-by download, execution of malicious code, or other suspicious activity originating from a browser.
Detects non-browser processes attempting to read or delete sensitive browser data files (e.g., Login Data, Cookies, Web Data, logins.json, cookies.sqlite) located in standard Windows browser paths. The rule specifically flags suspicious behavior involving file access and deletion patterns commonly associated with credential theft or 'browser-wiping' malware like Remcos.
Detects instances where browser processes (msedge.exe, chrome.exe) copy sensitive credential and session SQLite databases (e.g., Login Data, Cookies) to locations outside of the canonical User Data directories. This behavior is indicative of the StegoAd campaign, where malicious browser extensions stage these files for subsequent exfiltration.
This rule detects potential credential theft from web browsers (Edge/Chrome) by monitoring access to the 'Login Data' SQLite database file. It correlates file access events with subsequent outbound HTTPS connections to non-Microsoft and non-Google domains initiated by the same browser process within a 10-minute window, which is indicative of exfiltration of stolen browser credentials.
This rule detects potential unauthorized access to Azure Storage Blobs following the retrieval of storage account access keys. It correlates 'ListKeys' API events with subsequent blob access activities from either unrecognized IP addresses or via Shared Access Signature (SAS) tokens, indicating potential credential misuse.
Detects a PDF, SVG, HTML, or presentation attachment containing a QR code or extracted URL that leads into an enterprise authentication workflow. This rule is designed to identify phishing attempts where adversaries embed QR codes or malicious URLs within common document types to direct users to fake enterprise login pages for credential harvesting.
Page 79 of 206