Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
485 detections
Filters
Last updated
All Time
Detection languages
200
188
31
18
17
Contributors
91
85
52
46
41
Categories
231
206
198
105
58
Platforms
438
42
10
7
4
Products / Services
125
121
104
16
16
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
4
4
1
1
1
IDS Classtypes
3
1
IDS Protocols
1
This rule detects repeated access attempts (read or write) to files or directories commonly associated with software build artifacts (e.g., 'build', 'release', 'artifact', 'bin', 'dist'). It specifically looks for Security Event ID 4656, which indicates a handle to an object was requested, and filters out common system accounts to focus on user-initiated access. A high number of access attempts (5 or more) within an hour by a non-system user to these sensitive object names could indicate an attempt to compromise or exfiltrate software supply chain components.
Detects potential credential dumping activity where ManageEngine ADSelfService processes initiate other processes commonly associated with credential dumping, such as taskmgr.exe, lsass.exe, winlogon.exe, or wlrmdr.exe. This behavior could indicate an adversary attempting to extract credentials.
This rule detects command-line activity indicative of encryption key extraction or dumping. It looks for specific keywords like 'dumpkey', 'exportkey', 'savekey', 'keystore', and 'privkey' in the command line of processes such as 'servertool.exe', 'encrypt.exe', 'powershell.exe', and 'cmd.exe'. This activity is often associated with ransomware or other malicious software attempting to exfiltrate cryptographic keys.
Detects suspicious process execution patterns associated with the Miasma worm, which attempts to scrape GitHub Actions Runner.Worker process memory to extract masked secrets. This rule looks for specific command-line arguments used by memory dumping tools or scripts targeting the GitHub Actions Runner.Worker process, including `grep` for secret JSON structures, `python` targeting `/proc/pid/mem`, and specific shell pipeline combinations observed in Miasma payloads.
Detects the execution of 'memdump', a utility that captures physical or process memory, indicating potential memory scraping activity.
Detects reg.exe saving the SECURITY hive to \Windows\Temp\.
Detects Python scripts utilizing ctypes, ptrace, or process_vm_readv to perform advanced, programmatic memory scraping without relying on shell utilities. This activity can be indicative of credential dumping or other forms of sensitive data exfiltration from process memory.
correlate with additional signals before alerting.
Detects wmic shadowcopy create used to stage credential database extraction.
Detects wmic shadowcopy create used to stage credential database extraction.
Hunting rule for Atomic Red Team T1003 test "Send NTLM Hash with RPC Test Connection" (OS Credential Dumping) using command-line and process indicators derived from executor behavior.
Detects reg.exe saving the SAM hive directly to \Windows\Temp\, indicative of offline credential cracking.
Detects the execution of known credential extraction tools such as Mimikatz, LaZagne, Hashcat, or John the Ripper, indicated by specific keywords in the command line arguments. This rule monitors for process creation events (EventID 4688) where these tools are used in conjunction with keywords related to passwords, hashes, or credentials.
This rule detects repeated access attempts (read or write) to files or directories commonly associated with software build artifacts (e.g., 'build', 'release', 'artifact', 'bin', 'dist'). It specifically looks for Security Event ID 4656, which indicates a handle to an object was requested, and filters out common system accounts to focus on user-initiated access. A high number of access attempts (5 or more) within an hour by a non-system user to these sensitive object names could indicate an attempt to compromise or exfiltrate software supply chain components.
Detects the execution of known credential extraction tools such as Mimikatz, LaZagne, Hashcat, or John the Ripper, indicated by specific keywords in the command line arguments. This rule monitors for process creation events (EventID 4688) where these tools are used in conjunction with keywords related to passwords, hashes, or credentials.
This rule detects the execution of processes with command-line arguments indicative of credential theft tools such as Mimikatz, lsadump, sekurlsa, vault, cachedump, or hashdump. It specifically looks for these keywords within Security Event ID 4688 (a process creation event) logs.
This rule detects the attempted extraction of Slack API tokens (specifically 'xoxb-' prefixed tokens) from process command lines, combined with network activity to a specific IP address (216.126.225.129). This combination suggests an attempt to harvest and exfiltrate Slack tokens, potentially by the Megalodon CI/CD malware.
Detects Python accessing desktop authenticator, token, OTP, or MFA application databases and configuration. This rule specifically looks for Python processes executing with command-line arguments that indicate an attempt to interact with sensitive authenticator application data.
This rule detects suspicious process activity indicative of the Remcos RAT attempting to extract credentials from web browsers like Chrome, Firefox, or Opera. It specifically looks for `Remcos` related processes initiating browser executables with command-line arguments often associated with credential dumping or unusual browser behavior, such as `--allow-file-access`, `--no-sandbox`, `--headless`, or referencing a 'profile'.
Detects Python scripts accessing the /proc/*/mem file of the Runner.Worker process. This activity is indicative of memory scraping, potentially to extract sensitive information like masked GitHub Actions secrets, as observed with malware like Miasma.
Detects memory dumps piped to 'tr -d' to strip null bytes. This specific shell pipeline is a known Miasma technique used to parse raw process memory for readable secrets.
This rule detects commands executed within GitHub Actions build jobs that attempt to read memory from the GitHub Actions runner process. This technique is often used in supply-chain attacks to extract secrets that reside in the runner's memory during job execution. The rule specifically looks for command-line arguments containing '/proc' and 'Runner.Worker' along with keywords like 'mem', 'cmdline', 'grep', 'tr -d', or 'isSecret'.
Detects ptrace access to securityd process memory for credential extraction
Page 10 of 24