Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,456
11,839
5,876
5,155
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects malicious behavior attributed to the Miasma/TonRAT malware, specifically targeting node.js or bun.exe runtime environments. The rule identifies suspicious network connections to command and control (C2) domains, access to sensitive developer credential files (e.g., .npmrc, .aws/credentials), execution of identified credential-harvesting functions in process command lines, and the execution of specific suspicious preinstall scripts.
Detects unauthorized attempts to access or dump the memory of the Local Security Authority Subsystem Service (LSASS) process to harvest credentials. This rule covers known credential dumping tools like Pillager and Procdump, the abuse of built-in Windows diagnostic tools like comsvcs.dll, and Mimikatz-style credential harvesting commands (e.g., sekurlsa). It also includes a generic detection for suspicious processes attempting to open a handle to lsass.exe.
Detects unauthorized or suspicious access to sensitive files (AWS credentials, config, or SSH private keys) by processes spawned as children of common Integrated Development Environments (IDEs) or language runtimes. This pattern is characteristic of exploit chains like CVE-2026-12957, where malicious workspace configurations trigger automatic server execution, inheriting developer environment access to sensitive credential stores.
Detects the Amazon Q Developer language server or extension host spawning suspicious child processes (bash, sh, zsh, python, node) that execute commands involving AWS STS identity retrieval, external data exfiltration via network tools like curl/wget, or direct references to AWS credential environment variables. This pattern is indicative of potential Remote Code Execution (RCE) via malicious Model Context Protocol (MCP) auto-execution.
Detects attempts to inject attacker-controlled credentials into Entra ID Agent Blueprints via the Microsoft Graph addPassword endpoint. This activity is identified by monitoring Microsoft Graph activity logs for 'addPassword' requests and correlating with Audit Logs for 'Add password' operations targeting resources containing 'blueprint' or 'Blueprint', or where modified properties include 'Blueprint Secret', 'passwordCredential', 'addPassword', or the actor has the 'Agent ID Administrator' role.
Detects unauthorized processes, such as shells, scripting engines, or command-line utilities, that attempt to display or access environment variables containing sensitive cloud credential patterns (e.g., AWS_ACCESS, API_KEY). This behavior often indicates an attempt to steal cloud provider credentials from the host environment.
Identifies anomalous session cookie replays where a user token is suddenly used from an entirely different geographic location or ISP within minutes. This rule specifically looks for non-interactive sign-ins (indicating session cookie reuse) where a single AccountUpn shows sign-ins from at least two different IP addresses and two different geographic locations within a 10-minute window.
Detects sensitive Active Directory replication operations (DS-Replication-Get-Changes or DS-Replication-Get-Changes-All) initiated by accounts other than standard domain controllers. This behavior is a common indicator of DCSync attacks, where an adversary mimics a domain controller to request sensitive Active Directory data, such as password hashes, from a legitimate domain controller.
Detects attempts to exploit the Zerologon vulnerability (CVE-2020-1472) for privilege escalation and domain compromise. This rule monitors for a high volume of Netlogon secure channel failures (Event ID 5805), machine account password resets to a zeroed/blank state (Event ID 4742 for computer accounts with specific password indicators), anomalous Netlogon service restarts (Event ID 7036), and Azure AD Identity Protection risk events referencing Zerologon or Netlogon anomalies. These indicators collectively suggest an active exploitation attempt of the Zerologon vulnerability.
This rule detects unauthorized access attempts to Active Directory Directory Replication Services using Event ID 4662. It specifically monitors for the access mask 0x100 (Control Access) against the Domain Replication Service GUIDs, which are often indicative of techniques like DCSync used to harvest credentials or replicate the NTDS.dit database.
Detects unauthorized processes attempting to access sensitive browser files such as Login Data, Cookies, or Web Data for Google Chrome or Microsoft Edge. This activity is indicative of credential theft, where malicious actors attempt to extract stored passwords or session cookies from web browsers.
Detects anomalous process behavior characterized by rapid access to multiple sensitive credential files or enumeration of critical environment variables (e.g., cloud, AI, or cryptocurrency wallet keys). This behavior aligns with the mass credential harvesting techniques observed in the IronWorm/Shai-Hulud campaign.
This rule detects the addition of new certificates or client secrets to Azure App Registrations or Service Principals by a user who is not recorded as an owner of that application in the last 90 days. This behavior is a common persistence and privilege escalation technique used by attackers to maintain access to cloud environments.
Detects processes that access a threshold of five or more sensitive configuration, credential, or browser-stored login files within a single execution context, which is indicative of credential harvesting or automated collection activity.
This rule monitors for file access events (Sysmon Event ID 11) targeting sensitive web browser files, including logins (passwords), cookies, and web data, by processes other than the legitimate browser executables. Such access is a strong indicator of credential theft or session hijacking attempts.
This rule detects processes other than standard web browsers performing network connections that coincide with OAuth token acquisition activities (POST requests containing 'access_token' in the response body). This behavior is indicative of potential token theft or unauthorized programmatic access to OAuth-protected resources.
This rule detects potential credential dumping activity against the Local Security Authority Subsystem Service (LSASS) on a host shortly after a successful VPN logon. It correlates Sysmon Event ID 1 (Process Creation) representing known dumping techniques (Mimikatz, Procdump, or comsvcs.dll) with Windows Security Event ID 4624 (Logon) from a VPN source within a 5-minute window.
This rule monitors for file access events (Sysmon Event ID 11) targeting sensitive web browser files, including logins (passwords), cookies, and web data, by processes other than the legitimate browser executables. Such access is a strong indicator of credential theft or session hijacking attempts.
This rule detects potentially malicious OAuth activity in Azure AD where a user performs a device code authentication flow, followed by a refresh token request from a different, anomalous IP address or geographical location. This behavior is indicative of an attacker who has successfully phished a device code from a user and is now attempting to maintain persistent access to the account via a stolen refresh token.
Detects unauthorized processes attempting to access browser-stored credential files (Chrome, Edge, and Firefox) such as 'Login Data', 'Cookies', 'Local State', and 'logins.json'. The rule filters known browser processes and common password manager applications to reduce noise from legitimate software that manages or accesses these files.
Detects instances where a non-standard browser process accesses sensitive browser credential files (e.g., Login Data, Cookies, key4.db) and simultaneously establishes a network connection to Discord or transmits data to a Discord webhook. This pattern is consistent with infostealer malware attempting to exfiltrate cached credentials via external services.
Page 94 of 206