Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,456
11,839
5,876
5,155
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
Detects unauthorized processes attempting to access or perform operations on sensitive files such as browser credentials, SSH keys, crypto wallets, and password manager databases. The rule specifically looks for non-standard or unsigned processes interacting with a high volume of these files in a short time frame, which is indicative of credential harvesting by infostealer malware like Lumma, Redline, or Vidar.
Detects unauthorized access to Windows Credential Manager files, TokenBroker OAuth cache files, or the loading of crypt32.dll from suspicious, user-writable directories (e.g., Temp, Downloads, Desktop) by non-Microsoft or non-system processes. This activity is indicative of credential theft, session hijacking, or attempts to abuse the Windows Data Protection API (DPAPI) to decrypt sensitive local secrets.
This rule detects instances of the 'node.exe' process accessing file system paths associated with common browser-based cryptocurrency wallet extensions (such as MetaMask, Phantom, Coinbase Wallet, etc.). This behavior is highly suspicious as it indicates a potential attempt to steal local wallet data or seed phrases.
SearchProtocolExecution
YARA-L
Detects execution of processes containing 'search' or 'search-ms' in command line with 'crumb=location' parameter.
Detects unauthorized access (creation, modification, renaming, or deletion) to sensitive local credential files by the Node.js runtime process (node.exe/node). This behavior is indicative of infostealers, specifically noted in the Miasma/MYRA activity associated with the Polymarket Trap campaign, where malicious packages attempt to exfiltrate AWS, SSH, NPM, Python, Docker, and GPG credentials.
This rule detects when a Node.js process accesses sensitive files associated with cryptocurrency wallets (e.g., MetaMask, Phantom, Coinbase Wallet) or browser extension storage directories. This behavior is highly indicative of information-stealing malware attempting to extract private keys, wallet configuration files, or sensitive browser session data.
Detects file artifacts produced by the PostCSS typosquatting Windows RAT (abdrizak). Covers Chrome credential dump outputs (pwd.txt, chrome_logins_dump.txt), access to Chrome Login Data and Local State files by non-browser processes, and single-instance tracking files (.store, .host) written to the TEMP directory.
This rule detects potential brute force attacks against Azure AD accounts by identifying users with 10 or more failed sign-in attempts due to invalid credentials within a 5-minute window. It summarizes the failure count and associated IP addresses for each user.
Detects multiple failed Kerberos pre-authentication attempts (EventID 4771 with status codes 0x18 or 0x1f) from a single IP address against a target user within a short timeframe (20 attempts in 5 minutes). This pattern is indicative of a brute-force attack against Kerberos accounts.
This rule detects processes such as Node.js, npm, or Python accessing sensitive command-line history files including .bash_history, .zsh_history, .fish_history, or ConsoleHost_history.txt. Accessing these files, which often contain credentials or command execution history, is a common indicator of credential harvesting or post-exploitation reconnaissance.
This rule detects a high volume of failed object access attempts (EventID 4674) by a single user on a specific computer within a one-hour window. This could indicate an adversary attempting to discover or access sensitive resources, potentially as part of privilege escalation or data exfiltration efforts.
This rule detects when a user account repeatedly (3 or more times within an hour) requests either 'SeDebugPrivilege' or 'SeImpersonatePrivilege' (Event ID 4672). This behavior can be indicative of an attacker attempting to escalate privileges or manipulate access tokens, often seen in techniques like token impersonation or debugging processes for malicious purposes.
Detects rapid successive password changes to the default 'admin' account on Cisco SD-WAN controllers followed by a configuration rollback. This pattern indicates an adversary attempting to temporarily modify credentials for exploitation while attempting to evade detection by reverting to the original configuration state, specifically targeting NETCONF configuration commits.
Detects potential DCSync attacks by monitoring for Windows Event ID 4662 (Object Access) where a non-domain controller account exercises directory replication rights (DS-Replication-Get-Changes-All) against Active Directory domain objects. This identifies unauthorized attempts to pull sensitive credential data directly from a Domain Controller.
Detects instances where processes other than legitimate browser-related binaries access sensitive SQLite database files (Login Data and Cookies) associated with Google Chrome or Microsoft Edge. This activity is a common indicator of credential theft by malicious tools or scripts attempting to extract stored passwords or session cookies.
This rule detects potential AS-REP Roasting attacks by monitoring for Kerberos TGT requests (Event ID 4768) where Kerberos pre-authentication is disabled (PreAuthType == 0) and the ticket encryption type uses weak algorithms (RC4-HMAC or AES128). This behavior allows an attacker to request a ticket for an account and perform offline password cracking.
Detects potential DCSync attacks by monitoring for Windows Event ID 4662 (Object Access) where a non-domain controller account exercises directory replication rights (DS-Replication-Get-Changes-All) against Active Directory domain objects. This identifies unauthorized attempts to pull sensitive credential data directly from a Domain Controller.
Detects one web session posting username, password, and MFA or one-time-code form fields through the same intermediary host. This behavior is indicative of an Adversary-in-the-Middle (AiTM) attack, where an attacker intercepts and relays authentication requests, including multi-factor authentication (MFA) codes, to gain unauthorized access.
Detects a non-interactive sign-in using an existing session shortly after the user completes interactive MFA, which can indicate stolen token replay. This rule identifies scenarios where a user successfully completes an interactive multi-factor authentication (MFA) sign-in, and then, within a short time frame (1800 seconds or 30 minutes), a non-interactive sign-in occurs for the same user and session ID. This pattern is indicative of a stolen session token being replayed by an attacker, bypassing subsequent MFA prompts.
Detects unauthorized attempts to enumerate stored Windows credentials using native command-line utilities such as vaultcmd.exe and cmdkey.exe, or by invoking CredEnumerate/Get-StoredCredential functions via PowerShell scripts. These methods are commonly used by attackers to gain access to cached passwords, tokens, or network credentials stored in the Windows Credential Manager.
Detects unauthorized processes attempting to access browser cookie storage files, which are commonly targeted by infostealer malware to extract session cookies for services like Jira and Atlassian SSO. Extracting these tokens allows attackers to bypass multi-factor authentication (MFA) and gain unauthorized access to accounts.
Page 98 of 206