Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
983 detections
Filters
Last updated
All Time
Detection languages
638
105
82
64
34
Contributors
242
226
216
58
46
Categories
20,443
11,831
5,872
5,155
4,866
983
Platforms
483
405
224
192
62
Products / Services
416
383
182
108
81
MITRE Techniques
496
496
263
234
233
CVEs
4
4
4
3
3
IDS Classtypes
1
Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module.
Detects the attack technique pass the hash which is used to move laterally inside the network
Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.
sap impossible travel
YARA-L
Identifies two successful logons for the same User ID from two different geographic locations in a timeframe that is physically impossible to travel between, indicating credential sharing or theft.
Detects risky authentication from a non AD registered device without MFA being required.
Detects potential token impersonation and theft. Example, when using "DuplicateToken(Ex)" and "ImpersonateLoggedOnUser" with the "LOGON32_LOGON_NEW_CREDENTIALS flag".
Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.
Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.
Detects logon events that specify new credentials
Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account.
This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.
This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.
Hacktool Ruler
Sigma
This events that are generated when using the hacktool Ruler by Sensepost
Detects suspicious processes logging on with explicit credentials
sap multi terminal logon
YARA-L
Identifies successful logons for the same User ID from multiple different terminal IDs or client hostnames in a short timeframe, indicating potential credential sharing or session theft.
Detects a suspicious pattern in SAP environments where an existing user creates a new account (AU7 - User created) and subsequently logs into that newly created account (AU1 - User logged on or AU5 - User logged on via RFC) from the same terminal/IP address within a 30-minute window, potentially indicating account takeover or unauthorized persistence.
This rule detects impossible travel scenarios for Azure logins by calculating the speed required to travel between two consecutive login locations for the same user. It flags logins where the calculated speed exceeds the maximum speed of a commercial passenger aircraft (900 km/h) and the logins originate from different countries. Mobile device logins are excluded to reduce false positives related to VPN usage.
This rule detects impossible travel scenarios for Azure logins by calculating the speed required to travel between two consecutive login locations for the same user. It flags logins where the calculated speed exceeds the maximum speed of a commercial passenger aircraft (900 km/h) and the logins originate from different countries. Mobile device logins are excluded to reduce false positives related to VPN usage.
This rule detects interactive logons (LogonType 10) where a single account from the same domain logs into multiple distinct devices. This could indicate an attacker using compromised credentials to move laterally within the network or access multiple systems.
This rule is meant to help analysts quickly spot a high-confidence indicator related to Google NetNTLMv1 Deprecation RainbowTables. It is written to be easy to understand and to keep false alarms low by focusing on a very specific match: a Windows logon event that explicitly shows LM or NTLMv1 as the package used. A match does not automatically prove an attacker is currently active, and it does not prove a file was executed, but it does mean the event is important because it lines up with a public threat intelligence source. When this triggers, start by identifying the host, user, and timeframe involved, then decide whether the activity is expected for that system. If it is unexpected, preserve the related logs and any files, and look for nearby events that could explain how the indicator appeared, such as a download, a new process, or a new connection. If the same indicator appears on multiple systems, treat it as a scoping signal and expand the investigation window. Use the reference link (https://cloud.google.com/blog/topics/threat- intelligence/net-ntlmv1-deprecation-rainbow-tables) to document where the indicator came from and to support incident notes and reporting.
An attacker disables or weakens Windows auditing to reduce the visibility of system and user activity. This helps evade detection by security tools and analysts by preventing critical events from being recorded in Windows Event Logs.
This rule is meant to help analysts quickly spot a high-confidence indicator related to Google NetNTLMv1 Deprecation RainbowTables. It is written to be easy to understand and to keep false alarms low by focusing on a very specific match: a Windows logon event that explicitly shows LM or NTLMv1 as the package used. A match does not automatically prove an attacker is currently active, and it does not prove a file was executed, but it does mean the event is important because it lines up with a public threat intelligence source. When this triggers, start by identifying the host, user, and timeframe involved, then decide whether the activity is expected for that system. If it is unexpected, preserve the related logs and any files, and look for nearby events that could explain how the indicator appeared, such as a download, a new process, or a new connection. If the same indicator appears on multiple systems, treat it as a scoping signal and expand the investigation window. Use the reference link (https://cloud.google.com/blog/topics/threat- intelligence/net-ntlmv1-deprecation-rainbow-tables) to document where the indicator came from and to support incident notes and reporting.
This rule detects sign-in attempts by 'Break Glass' accounts. Break Glass accounts are emergency access accounts typically used in situations where normal administrative access methods are unavailable. Monitoring their usage is critical due to the high privileges usually associated with these accounts. The rule joins sign-in logs with a watchlist of identities to specifically identify activity related to these designated accounts.
Page 39 of 47