Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
252 detections
Filters
Last updated
All Time
Detection languages
109
48
29
20
15
Contributors
70
34
30
21
11
Categories
156
65
58
54
31
Platforms
129
107
62
33
16
Products / Services
39
36
27
19
18
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
5
4
2
1
1
IDS Classtypes
4
3
1
1
IDS Protocols
8
This analytic identifies more than 10 GetPasswordData API calls within a 5-minute window in an AWS account. It leverages AWS CloudTrail logs to detect this activity by counting the distinct instance IDs accessed. This behavior is significant as it may indicate an attempt to retrieve encrypted administrator passwords for running Windows instances, which is a critical security concern. If confirmed malicious, attackers could gain unauthorized access to administrative credentials, potentially leading to full control over the affected instances and further compromise of the AWS environment.
The analytic identifies `GetPasswordData` API calls in AWS CloudTrail logs from Amazon Security Lake. This activity is significant as it indicates an attempt to retrieve encrypted administrator passwords for running Windows instances. Attackers could gain unauthorized access to administrative credentials, potentially leading to full control over affected instances and further compromise of the AWS environment.
The following analytic detects non-Discord applications accessing the Discord LevelDB database. It leverages Windows Security Event logs, specifically event code 4663, to identify file access attempts to the LevelDB directory by processes other than Discord. This activity is significant as it may indicate attempts to steal Discord credentials or access sensitive user data. If confirmed malicious, this could lead to unauthorized access to user profiles, messages, and other critical information, potentially compromising the security and privacy of the affected users.
Detects when a secret is found in a GitHub repository. Adversaries may attempt to harvest leaked/exposed secrets to further infiltrate their target's environment, maintain access, or steal data.
Detects when the Single Sign-On (SSO) recovery codes are accessed for a GitHub enterprise or organization. An adversary may attempt to access or steal SSO recovery codes in order to maintain access to their target's GitHub environment.
Detects when a secret is found in a GitHub repository. Adversaries may attempt to harvest leaked/exposed secrets to further infiltrate their target's environment, maintain access, or steal data.
Detects when the AWS managed policy 'AWSCompromisedKeyQuarantine' is attached to an IAM user, role, or group. This policy is typically applied by AWS when credentials for an IAM entity are suspected of being compromised or publicly exposed, indicating a potential security incident.
This rule detects when a user in OneLogin reveals another user's application password. This is identified by monitoring 'USER_RESOURCE_ACCESS' events from 'ONELOGIN_SSO' where the product event type is '240' (indicating an actor user revealed a password to an app for another user) and the principal user ID is different from the target user ID. This scenario suggests unauthorized access or disclosure of credentials.
Detects usage of service account key from multiple countries using Chronicle GeoIP enrichment.
Detect when the AWS managed policy AWSCompromisedKeyQuarantine has been attached to a user, role, or group. It is applied by the AWS team in the event that the credentials of an IAM user has been compromised or publicly exposed.
Detects when a user revealed another user's application password.
Identifies when an encryption key file is accessed by an anonymous user in Google Drive. An adversary may attempt to access encryption keys before moving laterally and compromising sensitive data.
Detects attempts to query the contents of the event log using command line utilities such as `wevtutil.exe`, `wmic.exe`, and PowerShell cmdlets like `Get-WinEvent` or `Get-EventLog`. Attackers use this technique to find sensitive information in logs, such as credentials, usernames, or IP addresses.
This YARA rule detects the Daolpu infostealer by identifying specific byte patterns related to its core functionalities. These functionalities include network communication, searching for sensitive files on the system, parsing Firefox configuration files, and collecting browser passwords and cookies. The rule requires all these distinct patterns to be present within a file to trigger a detection, aiming to reduce false positives.
This rule detects the usage of cleartext protocols over a network by monitoring firewall logs for allowed connections to specific destination ports commonly associated with unencrypted services. These ports include HTTP (80, 8080), FTP (21), Telnet (23), and various database or application-specific ports (e.g., 1433, 3306, 1521, 27017, 50000, 11211, 15672, 5900-5904). The rule specifically looks for 'forward' or 'accept' actions, or connections not marked as 'blocked', indicating active cleartext communication. The primary goal is to identify potential credential exposure or sensitive data transmission over insecure channels.
This rule identifies when an Azure Key Vault is modified or deleted. Key Vaults store sensitive information such as cryptographic keys, certificates, and secrets. Unauthorized modification or deletion of a Key Vault could indicate an attacker attempting to disrupt services, remove evidence, or gain access to sensitive credentials. The rule specifically looks for operations related to writing, deleting, deploying, or modifying access policies of Key Vaults.
Detects when a new owner is added to an application in Azure AD. This action grants the newly added account privileges to modify and configure the application, which could be abused by an attacker to maintain persistence, elevate privileges, or access sensitive data.
Identifies when a key vault is modified or deleted.
Identifies when a Keyvault Key is modified or deleted in Azure.
Identifies when secrets are modified or deleted in Azure.
Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application.
Page 12 of 12