Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,309 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,445
11,833
5,875
5,151
4,864
4,309
Platforms
2,571
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,348
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
This rule detects a sequence of behaviors indicative of credential theft followed by data staging and exfiltration. It identifies processes accessing sensitive browser credentials or KeePass database files, followed by the creation of a ZIP archive within user profile directories, and concludes with an outbound HTTPS connection to a non-trusted, non-Microsoft external destination by the same process.
Identifies anomalous session cookie replays where a user token logs in without interactive MFA from an entirely different geographic location within minutes. This rule specifically looks for non-interactive sessions (IsInteractive == false) where a single AccountUpn (user) has IP addresses from two or more distinct geographic locations within a 30-minute window.
Detects processes that install a low-level keyboard hook (WH_KEYBOARD_LL) and are simultaneously involved in suspicious activity, such as network connections to non-private IP addresses and file writes to typical temporary directories (e.g., C:\Windows\Temp, C:\Users\Public). This behavior is characteristic of keylogging activity and subsequent data exfiltration or staging.
Detects a browser session that contacts an EvilTokens Device Code phishing endpoint (/api/device/status/) and then immediately navigates to onedrive.live.com. This indicates that the attacker's backend successfully returned 'status:completed' and the phishing kit executed a window.location.replace to redirect the victim to OneDrive after token capture.
Detects processes attempting to connect to the Cloud Instance Metadata Service (IMDS) IP address (169.254.169.254) or referencing it in the command line. This behavior is often associated with credential theft or reconnaissance on cloud instances.
This rule detects unauthorized attempts to create, modify, rename, or delete sensitive browser data files (such as Login Data, Cookies, key4.db, and logins.json) used for storing credentials. It monitors for access by processes that are not known browser executables or authorized system services, which is a common indicator of credential dumping by malicious software.
This rule detects attempts to acquire Windows credentials by accessing critical registry hives (SAM, SYSTEM, SECURITY) or their shadow copies. It looks for the use of 'reg save' to export hives, as well as direct file access to these hives or their shadow copy variations by non-standard system processes.
Detects unsigned or non-Microsoft processes attempting to access sensitive system process memory (lsass.exe, winlogon.exe, services.exe) or processes attempting to enable SeDebugPrivilege, which are common indicators of credential dumping or process injection attempts.
Detects when the node.js runtime process accesses Docker configuration files, which may contain sensitive authentication credentials or registry settings. This behavior is atypical for standard node.js applications and could indicate credential theft or unauthorized container environment interaction.
Detects Node.js runtime instances interacting with multiple sensitive developer configuration and credential files (e.g., .gitconfig, GitHub CLI host tokens, Claude configuration, git-credentials) in a single session. This pattern is consistent with infostealer malware (such as Miasma/MYRA) attempting to harvest developer credentials for downstream exploitation.
This rule detects unauthorized attempts by non-browser processes to access sensitive browser-related files (Login Data, Cookies, Web Data, etc.) or interact with browser processes to extract secrets. It monitors for Sysmon Event IDs 10 (ProcessAccess), 11 (FileCreate), 7 (ImageLoad), and 1 (ProcessCreate) where a suspicious process (often located in temporary or user profile directories) attempts to read or interact with known browser credential storage paths.
Detects instances of a Node.js process accessing sensitive browser credential and cookie storage files, which is a common behavior associated with credential theft malware or malicious scripts.
This rule detects potential unauthorized access to web browser data files (such as logins, cookies, and history databases) or specific registry modifications indicative of browser hijacking or credential theft. It monitors for processes other than known web browsers accessing sensitive browser configuration files or creating registry keys in HKCU that might be used for persistence or browser configuration manipulation.
This rule monitors Kerberos Ticket Granting Service (TGS) requests (Event ID 4769) for weak RC4-HMAC (0x17) encryption, which is a strong indicator of a Kerberoasting attack. It aggregates these requests to identify potentially malicious activity by grouping by account and destination service, while excluding legitimate machine accounts, built-in service identities, and internal Kerberos service requests.
The rule detects potential credential dumping activities by monitoring for the execution of Mimikatz or the use of its specific command-line arguments (e.g., sekurlsa::logonpasswords, /ntlm:). It also monitors for suspicious, unauthorized processes attempting to open a handle to the LSASS process to access its memory, a common technique for dumping credentials.
Detects potential DCSync attacks by monitoring for Windows Event ID 4662 (Object Access) where a non-domain controller account exercises directory replication rights (DS-Replication-Get-Changes-All) against Active Directory domain objects. This identifies unauthorized attempts to pull sensitive credential data directly from a Domain Controller.
This rule monitors Kerberos Ticket Granting Service (TGS) requests (Event ID 4769) for weak RC4-HMAC (0x17) encryption, which is a strong indicator of a Kerberoasting attack. It aggregates these requests to identify potentially malicious activity by grouping by account and destination service, while excluding legitimate machine accounts, built-in service identities, and internal Kerberos service requests.
This rule detects potential AS-REP Roasting attacks by monitoring for Kerberos TGT requests (Event ID 4768) where Kerberos pre-authentication is disabled (PreAuthType == 0) and the ticket encryption type uses weak algorithms (RC4-HMAC or AES128). This behavior allows an attacker to request a ticket for an account and perform offline password cracking.
This rule monitors Kerberos Ticket Granting Service (TGS) requests (Event ID 4769) for weak RC4-HMAC (0x17) encryption, which is a strong indicator of a Kerberoasting attack. It aggregates these requests to identify potentially malicious activity by grouping by account and destination service, while excluding legitimate machine accounts, built-in service identities, and internal Kerberos service requests.
Detects multiple processes accessing sensitive browser data files like 'Local State' and 'Login Data', commonly associated with credential theft activities from web browsers.
Detects behavior indicative of the Vidar information stealer, specifically the mass access of web browser credential stores (Login Data, Cookies) followed by the execution of archive utilities (7z, rar, WinRAR) to stage stolen data for exfiltration.
Page 83 of 206