Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
280 detections
Filters
Last updated
All Time
Detection languages
113
68
30
18
17
Contributors
91
44
38
32
7
Categories
148
66
58
36
33
Platforms
150
56
47
41
34
Products / Services
63
60
51
34
27
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
1
IDS Classtypes
14
11
4
1
1
IDS Protocols
23
4
1
1
Detects network connections to domains known to be used as infrastructure for an ongoing, highly evasive Evilginx phishing campaign targeting SSO portals.
Detects network connections to dedicated IP addresses previously used to host Evilginx phishing proxies. While the threat actor has reportedly shifted to using Cloudflare, these IPs represent past infrastructure and should be monitored for potential reuse.
Detects chromium-based browsers starting in headless and debugging mode while pointing to a user profile. This behavior can be indicative of data exfiltration, specifically cookie stealing, or remote control of the browser.
This rule detects network connections to known EvilGinx phishing infrastructure, identified by specific remote URLs, IP addresses, and a suspicious login URL pattern. EvilGinx is a phishing framework used for credential harvesting and session cookie theft, often employing adversary-in-the-middle techniques.
This rule detects PRT token stealing on a device when exploiting the MicrosoftAccountTokenProvider.dll, leveraging a WDAC audit policy to ingest missing Microsoft Defender for Endpoint events. This addresses a blind spot in default Defender for Endpoint detection.
This rule detects attempts by scripting language interpreters (Node.js, Python, PowerShell) to access sensitive browser credential files such as 'Login Data', 'Web Data', and 'Cookies' from Chrome and Brave browser user data directories. It also includes specific file paths that might be associated with known browser extensions or malware that target these files. This activity is indicative of credential dumping or information stealing.
KQL Query from file: Potential Session/Cookie Theft
KQL Query from file: Global Admin Entra Cookie with Chrome ZeroDay
KQL Query
Detects initial execution patterns and stealer activities used by KimJongRAT PE and PowerShell variants, including LNK/HTA execution, certutil decoding, rundll32 execution, and PowerShell-based data collection.
KQL Query from file: CVE-2024-7971 Patch Prioritization
'This rule identifies a web request with a user agent header known to belong to a hacking tool. This indicates a hacking tool is used on the host.<br>You can add custom hacking tool indicating User-Agent headers using a watchlist, for more information refer to the [UnusualUserAgents Watchlist](https://aka.ms/ASimUnusualUserAgentsWatchlist).
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM WebSession schema (ASIM WebSession Schema)'
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM WebSession schema (ASIM WebSession Schema)'
Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.
Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.
Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.
Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.
This query was originally published in the threat analytics report, Qakbot blight lingers, seeds ransomware
Qakbot is malware that steals login credentials from banking and financial services. It has been deployed against small businesses as well as major corporations. Some outbreaks have involved targeted ransomware campaigns that use a similar set of techniques. Links to related queries are listed under See also.
The following query detects possible use of the system process, esentutl.exe, to look through a user's browser history and steal cookies.
Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
Qakbot is malware that steals login credentials from banking and financial services. It has been deployed against small businesses as well as major corporations. Some outbreaks have involved targeted ransomware campaigns that use a similar set of techniques. Links to related queries are listed under See also.
The following query detects possible use of the system process, esentutl.exe, to look through a user's browser history and steal cookies.
Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
Detects attempts by uncommon processes to access sensitive Microsoft Teams files, specifically those containing authentication tokens (leveldb) and cookies. This rule aims to identify potential credential theft or unauthorized access to user sessions within Microsoft Teams.
This analytic identifies suspicious use of a session cookie by detecting multiple client values (IP, User Agent, etc.) changing for the same Device Token associated with a specific user. It leverages policy evaluation events from successful authentication logs in Okta. This activity is significant as it may indicate an adversary attempting to reuse a stolen web session cookie, potentially bypassing authentication mechanisms. If confirmed malicious, this could allow unauthorized access to user accounts, leading to data breaches or further exploitation within the environment.
This analytic identifies an AWS IAM account with concurrent sessions originating from more than one unique IP address within a 5-minute span. This detection leverages AWS CloudTrail logs, specifically the `DescribeEventAggregates` API call, to identify multiple IP addresses associated with the same user session. This behavior is significant as it may indicate a session hijacking attack, where an adversary uses stolen session cookies to access AWS resources from a different location. If confirmed malicious, this activity could allow unauthorized access to sensitive corporate resources, leading to potential data breaches or further exploitation.
This rule detects suspicious Okta login attempts where a stolen web session cookie might be reused. It specifically looks for a single user (identified by `userid`) attempting to log in from multiple distinct IP addresses AND from multiple distinct browsers or operating systems within a one-hour window. This behavior is indicative of an adversary attempting to bypass authentication mechanisms by replaying a stolen session cookie from a different device or location.
Page 13 of 14