Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,437
11,828
5,871
5,150
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects unauthorized processes attempting to read or create sensitive browser credential files ('Login Data', 'Web Data', 'Cookies', 'logins.json', 'key4.db'). This activity is commonly associated with information-stealing malware (such as Lumma, StealC, Vidar, RedLine, and Amadey) that targets browser databases to extract stored secrets, often bypassing standard browser process access.
This rule detects a multi-stage attack chain where a device shows signs of credential theft (accessing browser credential stores or cookies) followed closely by a successful cloud authentication from that same user using a device identifier not previously observed in the last 30 days.
Detects instances where a user account associated with a detected infostealer malware infection (e.g., Redline, Raccoon, Vidar) successfully authenticates to a cloud service from a suspicious network location, such as a VPN, residential proxy, or Tor exit node, within 24 hours of the infection alert.
Detects non-CLI and non-DevOps utility processes accessing sensitive cloud credential and configuration files, including AWS SSO caches, AWS credentials, kubeconfig, and gcloud configuration files. This behavior is indicative of credential theft or discovery by infostealers attempting to gain unauthorized access to cloud environments.
This rule identifies suspicious post-exploitation activity where an anomalous or unauthenticated NetScaler VPN session (potentially exploiting CVE-2026-88771 or CVE-2026-88772) is followed by the creation or modification of SSH authorized_keys files or related credential manipulation commands on internal hosts, suggesting an attacker establishing persistence.
This rule detects potential credential stuffing attacks by monitoring high-volume authentication attempts against web application login endpoints. It specifically flags scenarios where a high number of unique source IP addresses interact with a login endpoint (e.g., /login, /signin) within a short window, which is characteristic of automated, distributed credential stuffing tools using proxy networks to rotate IPs.
Detects the use of the built-in Windows utility rundll32.exe to execute the MiniDump functionality within comsvcs.dll against the Local Security Authority Subsystem Service (LSASS). This technique is a common method for attackers to bypass signature-based security tools and obtain sensitive credentials from memory.
Detects potential Pass-the-Hash (PtH) activity where a single user account performs NTLM Type 3 (network) authentications to three or more unique destination hosts within a 10-minute window, excluding service account activity (trailing $). This pattern is consistent with an adversary moving laterally across a network using harvested NTLM hashes.
Detects a sequence of authentication activity indicative of a credential stuffing attack. The rule identifies a burst of failed password-only authentication attempts followed by a successful authentication for the same account. It requires that the IP address used for the successful login overlaps with the set of IPs that initiated the failed attempts, effectively filtering out typical user noise and highlighting potentially malicious activity where an attacker has identified a valid credential.
Detects network traffic associated with Adversary-in-the-Middle (AiTM) phishing kits that impersonate Microsoft and Google login pages. The rules identify the presence of specific HTML elements (like Cloudflare Turnstile anti-bot gates) and authentication session cookie headers served from non-authorized/non-official domains, indicating a reverse-proxy phishing attack.
Detects potential Pass-the-Hash (PtH) activity by monitoring for NTLM network logons (Logon Type 3) that are associated with a blank WorkstationName, often indicating spoofing. This pattern is correlated with the assignment of special privileges (EventID 4672) to capture scenarios where stolen NTLM hashes are replayed for lateral movement into a system.
Detects Kerberos TGS requests using RC4 encryption (0x17), which is a common indicator of Kerberoasting. By monitoring Event IDs 4768 and 4769 for this specific encryption type, this rule identifies potential attempts to offline-crack service account passwords.
Detects Kerberos TGT (4768) or TGS (4769) tickets that exhibit anomalous characteristics often associated with forged tickets (e.g., Golden Ticket). The rule flags tickets using weak encryption (RC4-HMAC, legacy DES), tickets requested for stale/disabled accounts, or tickets with lifetimes exceeding standard domain policy thresholds.
Detects potential Pass-the-Hash lateral movement by identifying NTLM network/remote-interactive logons from a single user account across three or more distinct destination hosts within a 15-minute window, correlated with the usage of common credential-dumping tools or commands on the source host.
Detects high volumes of TGS-REQ events using RC4 encryption (etype 0x17) originating from a single account within a 10-minute window, excluding known service accounts and computer accounts. This pattern is often indicative of an adversary attempting to harvest service account tickets for offline brute-force cracking.
This rule detects potential Golden Ticket activity by identifying Kerberos TGS requests (Event ID 4769) that lack a corresponding prior TGT request (Event ID 4768) for the same user and IP address. This behavior is characteristic of offline forged Kerberos tickets where an attacker uses a compromised KRBTGT hash to create authentication tickets without interacting with the Key Distribution Center for the initial TGT.
Detects the creation of application-specific passwords named 'ZimbraWeb' in Zimbra environments. This pattern is associated with potential persistence mechanisms or credential access attempts where an adversary creates a dedicated service or app password to maintain access, as identified in CVE-2025-66376.
Detects Azure AD / M365 audit log events associated with OAuth2 permission grants or application consent
where a high-privilege delegated scope (e.g. Mail.Read, Mail.ReadWrite, Directory.ReadWrite.All, offline_access)
is granted to an application. This technique has been publicly attributed to APT29 (Cozy Bear / Midnight Blizzard)
for maintaining persistent access to M365 mailboxes and directory data via malicious or unverified OAuth
applications, consistent with MITRE ATT&CK T1098.001 (Additional Cloud Credentials) and T1550.001 (Use Alternate
Authentication Material: Application Access Token).
where a high-privilege delegated scope (e.g. Mail.Read, Mail.ReadWrite, Directory.ReadWrite.All, offline_access)
is granted to an application. This technique has been publicly attributed to APT29 (Cozy Bear / Midnight Blizzard)
for maintaining persistent access to M365 mailboxes and directory data via malicious or unverified OAuth
applications, consistent with MITRE ATT&CK T1098.001 (Additional Cloud Credentials) and T1550.001 (Use Alternate
Authentication Material: Application Access Token).
Detects an authentication pattern characteristic of credential compromise, consisting of a burst of failed authentication attempts against an account within a short window, followed immediately by a successful sign-in from an anomalous or new device/location. This pattern is indicative of brute-force or credential spraying followed by successful validation and potential lateral movement.
Detects anomalous use of an AI agent session or OAuth token from multiple distinct IP addresses, hostnames, or user-agents within a short 10-minute window. This behavior is highly indicative of token theft and replay, where an adversary attempts to use a compromised session token from a different location or environment.
Detects unauthorized processes attempting to read sensitive wallet extension storage files or desktop application wallet data folders, a behavior characteristic of the Psychedelic Stealer malware designed to harvest cryptocurrency credentials prior to exfiltration.
Page 8 of 206