Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
983 detections
Filters
Last updated
All Time
Detection languages
638
105
82
64
34
Contributors
242
226
216
58
46
Categories
20,443
11,831
5,872
5,155
4,866
983
Platforms
483
405
224
192
62
Products / Services
416
383
182
108
81
MITRE Techniques
496
496
263
234
233
CVEs
4
4
4
3
3
IDS Classtypes
1
This rule detects suspicious activity where a process attempts to access browser credential files (e.g., login data, cookies) shortly after a VPN logon event on the same device and by the same user. This could indicate an attacker attempting to steal credentials after gaining initial access or establishing a VPN connection.
This rule detects potential AS-REP Roasting activity by monitoring for a single source IP address requesting Kerberos TGTs (Event ID 4768) for multiple distinct user accounts within a 10-minute window. This behavior often indicates an attacker attempting to identify and harvest Kerberos pre-authentication hashes from accounts that do not require pre-authentication, which can then be cracked offline.
Detects successful logon events (4624) or special logon attempts (4648) associated with accounts or workstations identified as Qualys scanner agents. This is typically used to identify or baseline vulnerability scanning activity across the environment.
Detects Kerberos service ticket requests (TGS) where the encryption type is set to 0x17 (RC4-HMAC). This is commonly used in Kerberoasting attacks to capture service ticket hashes for offline brute-force attacks.
Detects NTLM network logons (LogonType 3) where the workstation name does not match the target computer name and is not a machine account. This pattern is commonly associated with lateral movement techniques such as Pass-the-Hash or other credential relay attacks, where an adversary authenticates to a remote system using compromised credentials.
Detects successful user sign-ins from a country that has not been observed in the user's sign-in activity over the past 30 days. This baseline helps identify potentially compromised accounts by surfacing geographic anomalies.
Detects instances where a user successfully authenticates using Multi-Factor Authentication (MFA) from one location, followed by a Single-Factor Authentication (SFA) logon from a different location within a 10-minute window. This behavior is indicative of potential session hijacking or session cookie theft where an attacker reuses an authenticated session or manipulates the authentication flow to bypass MFA requirements.
Detects anomalous authentication behavior consistent with an Adversary-in-the-Middle (AiTM) attack, where a single user account triggers multiple MFA challenge requests from distinct source IP addresses within a two-minute window. This behavior is indicative of an adversary proxying authentication requests in real-time between the user and a legitimate service.
Detects successful remote logons (LogonType 3 or 10) to Windows systems using highly privileged accounts (admin, administrator, root, or service-specific accounts) where the source IP address is external to defined private network CIDR ranges. This pattern is indicative of potential unauthorized access or compromised credentials.
This rule detects potentially malicious use of Managed Service Provider (MSP) credentials by correlating network or explicit authentication events (Logon Types 3, 9, or 10) occurring outside of typical business hours or originating from VPN/private network ranges, with concurrent SSH process activity on the same host. This pattern suggests an adversary may be using compromised credentials to move laterally or persist within an environment via SSH.
This rule detects unauthorized access attempts to Active Directory Directory Replication Services using Event ID 4662. It specifically monitors for the access mask 0x100 (Control Access) against the Domain Replication Service GUIDs, which are often indicative of techniques like DCSync used to harvest credentials or replicate the NTDS.dit database.
This rule detects potential credential dumping activity against the Local Security Authority Subsystem Service (LSASS) on a host shortly after a successful VPN logon. It correlates Sysmon Event ID 1 (Process Creation) representing known dumping techniques (Mimikatz, Procdump, or comsvcs.dll) with Windows Security Event ID 4624 (Logon) from a VPN source within a 5-minute window.
This rule detects authentication events for service accounts (matching patterns like 'svc', 'sa', 'service') originating from at least two different countries within a short time window (30 minutes or less), indicating potential credential compromise and anomalous geographic movement.
Detects potential Pass-the-Hash (PtH) activity by identifying NTLM Type 3 logons where the account domain originates from outside the local or known corporate domain. The rule specifically excludes system-related accounts such as ANONYMOUS LOGON, WORKGROUP, and NT AUTHORITY, focusing on attempts to authenticate against internal resources using potentially forged or captured credentials.
This rule detects the execution of Impacket toolkit modules (such as psexec.py, wmiexec.py, secretsdump.py) via EDR process events, as well as potential lateral movement patterns identified by NTLM authentication (Logon Type 3) to ADMIN$ or IPC$ shares. This combination of signals is indicative of credential dumping, remote service execution, or lateral movement using techniques often employed by the Impacket suite.
Detects potential password spraying or brute force activity by monitoring Windows Event Code 4625. The rule identifies source IP addresses that have attempted to authenticate against more than 10 unique accounts within a 5-minute window, calculating a spray ratio to differentiate high-intensity credential spraying attempts.
Detects Microsoft Entra ID (formerly Azure AD) sign-in logs where a single user account authenticates from two different countries within a 10-minute window, which is indicative of potential account compromise or credential sharing.
This rule monitors Linux authentication logs for anomalies related to Pluggable Authentication Modules (PAM). It identifies potential security risks by detecting file operations (read, write, create) within PAM-related processes, references to world-writable or temporary directories that may be used for staging credentials, and unusual authentication event patterns.
Detects NTLM-authenticated network logons (Logon Type 3) originating from loopback IP addresses (127.0.0.1, ::1, or 0.0.0.0). This behavior is often associated with NTLM relay attacks or credential reflection bypass techniques where an adversary forces a local service to authenticate to itself to gain unauthorized access.
Detects network logon events (Logon Type 3) using NTLM authentication where the source IP address is local (127.0.0.1 or ::1). This behavior can be indicative of attempts to interact with local services or perform lateral movement within the same host using credential-based techniques such as 'Pass-the-Hash' or unauthorized access to local resources.
This rule detects potential SSH brute force attacks by identifying high-frequency authentication failures from sshd logs (more than 10 failures in 5 minutes) and rapid, potentially automated connection attempts on port 22 (more than 20 connections in 1 minute) originating from the same source IP on Linux systems.
Page 34 of 47