Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,456
11,839
5,876
5,155
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
This rule detects the creation of Temporary Access Passes (TAPs) via the Microsoft Graph API targeting highly privileged accounts. This activity could indicate an attacker abusing a service principal with UserAuthMethod-TAP.ReadWrite.All permissions to gain temporary access to critical accounts like Global Administrators, Privileged Role Administrators, or Security Administrators. The rule specifically looks for POST requests to the 'temporaryAccessPassMethods' endpoint in Microsoft Graph Activity Logs and correlates this with IdentityInfo to identify if the target user holds a privileged role.
This rule uses regular expressions to identify distinct URL structures associated with the Tycoon2FA AiTM (Adversary-in-the-Middle) phishing kit. Specifically, it looks for URIs containing patterns like "?auth=" followed by a base64-encoded string or "/login?email=" followed by a base64-encoded string, which are indicative of the kit's operation to capture credentials or session tokens.
Detects the execution of command-line tools associated with Kerberoasting and Kerberos ticket manipulation techniques, such as requesting TGS tickets or targeting specific user accounts for ticket extraction.
This rule detects anomalous sign-in attempts to VPN or SSO services by identifying deviations from a user's established baseline of device and location combinations. It flags sign-ins where there are at least two anomalies (new country, new ASN, new device ID, new user agent), or specific critical combinations like a new country and new device, or an unmanaged device signing in from a new country or ASN. This pattern is consistent with adversaries using stolen credentials, potentially from infostealer logs, to access enterprise resources.
Detects unauthorized cross-process memory access attempts targeting the Local Security Authority Subsystem Service (lsass.exe). Such attempts are commonly associated with credential dumping techniques to extract credentials from memory.
Detects a sequence of events indicative of a successful phishing attack: a user receives an email containing a suspected phishing URL, clicks the URL, and subsequently performs a successful sign-in from an IP address not seen in their recent 14-day history within 15 minutes of the click.
Correlates the execution of commands or Graph calls attempting to list Global Administrators or highly privileged roles within the tenant, specifically looking for 'List directory roles' actions combined with Azure AD sign-in events from non-corporate IP addresses.
Detects GitHub Actions runner processes (e.g., node, bash, python) accessing sensitive CI/CD environment variables (GITHUB_TOKEN, NPM_TOKEN) followed within 30 seconds by an outbound network connection to a non-GitHub domain. This pattern is indicative of potential secret exfiltration by compromised CI/CD pipelines or malicious build steps.
Detects AMOS malware presenting a fake System Preferences password dialog via osascript to harvest user credentials, followed by validation using dscl -authonly. This is a key technique in the macOS ClickFix campaign delivering Atomic macOS Stealer.
Detects modifications to the 'Authentication Packages' registry key that include a DLL, which can be used for persistence by adversaries. The Local Security Authority (LSA) process loads these DLLs at system startup.
Detects suspicious access to browser credential stores (Google Chrome, Microsoft Edge, Mozilla Firefox, Brave) by non-browser processes within a short time frame (2 hours) after a FortiClient VPN logon event. This activity is consistent with information stealer malware, such as LummaC2, Phantom Stealer, Aurora Stealer, Luca Stealer, and Formbook, often observed in post-compromise phases of campaigns like FortiBleed.
Detects a network-connected Linux process exhibiting beaconing behavior (high-frequency external connections) that is subsequently correlated with unauthorized file access to sensitive Linux configuration files (/etc/passwd, /etc/shadow, or authorized_keys). This rule filters out common system processes and standard management binaries, targeting suspicious command-and-control activity combined with credential theft.
Detects the execution of known Kerberoasting tools or commands that indicate an attempt to request Kerberos service tickets for offline cracking. This activity is a core component of the Kerberoasting attack technique.
Detects the execution of known NTLM relay and credential harvesting tools such as Responder, Inveigh, and PetitPotam, or suspicious command-line patterns involving the use of 'net use' or common Windows binaries (e.g., powershell.exe, rundll32.exe) to access or force SMB authentication with remote IP addresses.
This rule detects network connections where an 'access_token=' string is present in the additional fields of network events, excluding common legitimate authentication domains like Google, Microsoft, and GitHub. This could indicate the exposure of sensitive access tokens over the network.
Detects anomalous processes targeting modern AI developer credential files and configuration files for tools like Claude, Gemini, and Cursor, a behavior exhibited by IronWorm.
This rule detects suspicious activity where a process attempts to access browser credential files (e.g., login data, cookies) shortly after a VPN logon event on the same device and by the same user. This could indicate an attacker attempting to steal credentials after gaining initial access or establishing a VPN connection.
This rule detects successful sign-ins using the OAuth 2.0 Device Code Flow. This flow is often abused in phishing attacks (device code phishing) where an attacker tricks a user into authenticating a malicious application. A successful sign-in using this method could indicate a compromised account or a successful phishing attempt.
Detects Microsoft 365 sign-ins using the device code grant flow from an unusual location or a previously unseen/unmanaged device. This behavior is consistent with OAuth phishing abuse, specifically 'device code phishing' where an adversary tricks a user into entering a code/credentials on a malicious authorization page to obtain a device token.
This rule detects potential AS-REP Roasting activity by monitoring for a single source IP address requesting Kerberos TGTs (Event ID 4768) for multiple distinct user accounts within a 10-minute window. This behavior often indicates an attacker attempting to identify and harvest Kerberos pre-authentication hashes from accounts that do not require pre-authentication, which can then be cracked offline.
Detects unauthorized or non-standard attempts to replicate directory data from a Domain Controller, specifically looking for Directory Replication Service (DRS) GetChanges and GetChangesAll access requests. This behavior is indicative of a DCSync attack, often used by adversaries to dump credentials from the NTDS.dit database.
Page 92 of 206