Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,588 detections
Filters
Last updated
All Time
Detection languages
830
199
132
116
107
Contributors
608
289
249
88
63
Categories
20,440
11,814
5,871
5,145
4,864
1,588
Platforms
1,255
461
295
76
68
Products / Services
530
382
139
113
85
MITRE Techniques
629
565
504
437
297
CVEs
5
4
3
3
3
IDS Classtypes
5
2
2
1
IDS Protocols
5
3
2
The analytic detects suspicious access or modification of the sshd_config file on Linux systems. It focuses on command-line executions involving processes like "cat," "nano," "vim," and "vi" accessing the sshd_config file. Unauthorized changes to sshd_config can allow threat actors to redirect port connections or use unauthorized keys, potentially compromising the system, leading to unauthorized access, privilege escalation, or persistent backdoor access.
This rule detects potential attempts to steal browser data by monitoring process creation events for specific command-line utilities (copy, move, xcopy, robocopy, esentutl) combined with paths commonly associated with web browser user data directories. Adversaries often acquire credentials from web browsers by copying or moving these files, which may contain saved usernames and passwords.
This rule detects when anonymous links are used to access files from OneDrive. While not always malicious, some organizations prohibit anonymous links due to data leakage risks. The rule specifically looks for 'USER_RESOURCE_ACCESS' events with 'FileAccessed' product event type from Office 365, where the principal user ID indicates an anonymous access (e.g., 'urn:spo:anon#' or 'anonymous').
Anonymous links can be used to export files from OneDrive. While this isn't always a sign of malicious activity, some organizations do not support the use of anonymous links because of the risk of data leakage. This rule detects when anonymous links are used to access files from OneDrive.
Anonymous links can be used to access files from OneDrive. While this isn't always a sign of malicious activity, some organizations do not support the use of anonymous links because of the risk of data leakage. This rule detects when anonymous links are used to access files from OneDrive.
This detects when a 401 Unauthorized status is received on multiple attempts of the same file when attempting to download from OneDrive and may indicate a permissions issue for the user.
This detects when a 401 Unauthorized status code is returned when attempting to download multiple unique files from OneDrive and may indicate a permissions issue for the user.
This rule identifies when an encryption key file is accessed (downloaded, viewed, or copied) by an anonymous user in Google Drive. This activity could indicate an adversary attempting to gain access to sensitive encryption keys before moving laterally or compromising data.
This rule detects access to the 'wceaux.dll' file, which is associated with the Windows Credential Editor (WCE) tool. This activity is indicative of an attempt to perform pass-the-hash remote command execution, often used for credential dumping and lateral movement. The rule specifically looks for Security Event IDs 4656 (A handle to an object was requested) or 4663 (An attempt was made to access an object) where the accessed object's name ends with '\wceaux.dll'.
Identifies when a Google Workspace user shares a file on Google Drive after a suspicious login event occurred.
Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host
Identifies when an encryption key file is accessed by an anonymous user in Google Drive. An adversary may attempt to access encryption keys before moving laterally and compromising sensitive data.
Detects attempts to discover password policy information on Linux systems by monitoring access to key configuration files and the execution of 'chage' and 'passwd' commands with specific arguments.
Detects password policy discovery commands
Detects file access requests to the Windows Sysvol Policies Share by processes that are not commonly expected to interact with these files. This could indicate an adversary attempting to discover or exploit Group Policy Preferences for credential access or other malicious purposes.
Detects suspicious access to Microsoft Teams application's authentication tokens and local storage, which may contain sensitive credentials. This rule specifically looks for Event ID 4663 (Object Access) where the accessed object path contains '\Microsoft\Teams\Cookies' or '\Microsoft\Teams\Local Storage\leveldb', and the accessing process is NOT the legitimate 'Teams.exe'. This indicates an attempt by an unauthorized process to steal Teams authentication tokens.
Detects remote credential dumping activity using Impacket's secretdump tool by monitoring SMB file access patterns. Specifically, it looks for access to the ADMIN$ share with paths containing 'SYSTEM32\' and ending with '.tmp', which is characteristic of secretdump creating temporary files during its operation.
This rule detects access to specific '.lock' and '.pid' files in the '/var/run/' directory, which are known indicators of the BPFDoor backdoor. The rule specifically looks for access to 'haldrund.pid', 'xinetd.lock', and 'kdevrund.pid'.
This rule detects the execution of the 'sqlite' or 'sqlite3' binary specifically when it is used to query sensitive data from Chromium-based browser profiles. The detection logic looks for command-line arguments that indicate access to common Chromium user data paths and specific database files containing login data, cookies, web data (credit cards, autofill), history, or bookmarks. This activity is highly indicative of an attempt to steal sensitive user information stored by web browsers.
Detects the usage of the 'find' command on macOS with specific permission-related arguments. These arguments are often used by attackers during discovery phases to locate files with unusual permissions, such as SUID/SGID binaries or world-writable files, which could indicate potential privilege escalation vectors or misconfigurations.
Detects access to files and shares with specific names and extensions associated with BlueSky ransomware, indicating a potential or active encryption attempt. The rule looks for files ending with '.bluesky' or containing 'DECRYPT FILES BLUESKY' in their names, across both local file access events (EventID 4663, 4656) and network share access events (EventID 5145).
Page 75 of 76