Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,453
11,838
5,876
5,154
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
This rule detects when a user adds mailbox permissions to three or more mailboxes within a one-hour window in Exchange Online. This behavior can indicate an adversary attempting to gain persistent access to multiple mailboxes, often for data exfiltration or further compromise.
Detects Node.js or npm processes accessing sensitive developer configuration and credential files. This rule is designed to identify malicious supply chain activity, specifically matching patterns where npm postinstall scripts or malicious node modules attempt to exfiltrate files such as .gitconfig, SSH keys, cloud credentials, and tokens from a developer workstation.
Detects the specific ShinyHunters lateral movement pattern involving automated SSH credential spraying using 'sshpass' or rapid SSH connections to multiple hosts with PeopleSoft admin accounts, often after reading '/etc/hosts'. The rule identifies suspicious SSH activity by looking for 'sshpass' execution or multiple 'ssh' commands with specific PeopleSoft-related usernames, potentially preceded by commands to read '/etc/hosts'.
Detects potential DCSync attacks by monitoring for Windows Event ID 4662 (Object Access) where a non-domain controller account exercises directory replication rights (DS-Replication-Get-Changes-All) against Active Directory domain objects. This identifies unauthorized attempts to pull sensitive credential data directly from a Domain Controller.
Detects unauthorized access to sensitive cryptographic files, such as SSH private keys, GPG secret keys, or Windows certificate store files, by unauthorized or anomalous processes (specifically node/npm or processes within /tmp). This is followed by potential outbound exfiltration via an external network connection or the mass access of multiple sensitive files within a short timeframe.
This rule detects potential clipboard data theft by monitoring Windows Sysmon Event ID 10 for process access events involving clipboard-related APIs (OpenClipboard, GetClipboardData) by untrusted processes, and PowerShell Script Block Logging (Event ID 4104) for the use of Get-Clipboard cmdlets. This identifies attempts by non-standard or unauthorized processes to access sensitive information copied by a user.
This rule detects potential unauthorized access to Azure Storage Blobs following the retrieval of storage account access keys. It correlates 'ListKeys' API events with subsequent blob access activities from either unrecognized IP addresses or via Shared Access Signature (SAS) tokens, indicating potential credential misuse.
This rule detects potential clipboard data theft by monitoring Windows Sysmon Event ID 10 for process access events involving clipboard-related APIs (OpenClipboard, GetClipboardData) by untrusted processes, and PowerShell Script Block Logging (Event ID 4104) for the use of Get-Clipboard cmdlets. This identifies attempts by non-standard or unauthorized processes to access sensitive information copied by a user.
This rule detects when a non-administrative user grants an application high-privilege OAuth scopes (such as mail reading, file access, or directory management) within an Azure/Microsoft 365 environment. Such consent grants can be used by attackers to maintain persistence and bypass MFA by gaining delegated access to sensitive resources.
Detects unauthorized processes attempting to access sensitive local browser files (credential stores, cookies, and local state databases) associated with Chrome, Edge, Brave, Chromium, and Firefox. Such access is a primary indicator of infostealer malware attempting to harvest saved credentials and session cookies from a victim's machine.
Detects unauthorized access to sensitive browser credential files (Login Data, Cookies, logins.json) by processes other than standard browsers or known security products. This activity is a common indicator of credential harvesting by infostealer malware families aiming to compromise saved passwords and session cookies.
Detects the transmission of potential sensitive information, such as passwords, tokens, API keys, or private keys, within Microsoft Teams chat messages by matching message content against a regular expression pattern for common credential formats.
Detects suspicious process activity originating from common build and package management tools (node, npm, bun, npx) that targets sensitive cloud and container credential locations, such as AWS IMDS, AWS configuration files, Kubernetes service account tokens, and HashiCorp Vault secrets. This rule is designed to identify malicious post-installation scripts or build processes attempting to exfiltrate credentials from developer or CI/CD environments.
Detects attempts to access browser credential stores or LSASS process memory by unexpected processes. This rule identifies suspicious file access patterns to browser login data files (Chrome, Edge, Firefox, Brave) by non-browser executables, as well as unauthorized access to LSASS process memory via Sysmon Event ID 10 or Windows Security Event 4656 by non-system processes. These activities are indicative of credential dumping or theft.
This rule detects known credential dumping activity, specifically focusing on the execution of Mimikatz (or renamed variants) and the use of built-in system tools like comsvcs.dll or procdump to dump lsass.exe process memory.
This rule detects unauthorized processes attempting to access sensitive web browser files (such as Login Data, Cookies, and Web Data) which store credentials, sessions, and history. It monitors file access events specifically targeting Chrome, Edge, and Firefox profiles, while excluding expected legitimate browser process names.
Detects the execution of specific Python scripts associated with the FortiBleed campaign. These scripts include 'spray_da.py' for domain admin password spraying, 'smb_test.py' for SMB validation and lateral movement, 'spider.py' for Active Directory crawling, and 'ad_full_audit.py' for Active Directory auditing. Detection is based on the Python interpreter executing these specific script filenames.
Detects attempts by explorer.exe to access browser credential and cookie files from common web browsers (Chrome, Edge, Firefox). This activity is highly suspicious as explorer.exe is not typically involved in legitimate access to these sensitive files, suggesting potential credential theft or reconnaissance.
Detects unauthorized processes attempting to access sensitive browser credential stores, such as Login Data, Cookies, or Local State, typically targeted by the Millenium RAT (DotStealer component) to harvest credentials and bypass Chromium App-Bound encryption.
Detects Millenium RAT (or similar malware associated with the Y2K Operators campaign) writing keystroke capture files to user APPDATA directories. The rule specifically monitors file creation events by non-browser/non-UI processes that utilize suspicious file extensions (.g0, .txt, .log, .dat).
Detects non-browser processes (e.g., non-standard executables) attempting to read sensitive browser data files, specifically Login Data, Cookies, or Firefox profile data. This behavior is highly characteristic of credential-stealing malware or unauthorized data exfiltration tools accessing browser-stored secrets.
Page 89 of 206