Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
707 detections
Filters
Last updated
All Time
Detection languages
362
144
48
42
25
Contributors
209
170
72
54
41
Categories
485
297
189
112
77
Platforms
413
316
165
62
53
Products / Services
162
112
62
36
34
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
707
CVEs
5
5
4
3
2
IDS Classtypes
15
5
4
2
IDS Protocols
24
2
1
Detects a network connection to an external SMB or WebDAV server immediately following the launch of a .url file. This behavior is associated with CVE-2024-43451, where threat actors use malicious .url files to leak NTLM hashes.
Detecting attempts to extract passwords with grep
Detects the execution of TruffleHog, a tool designed to search for secrets across various platforms such as Git, Jira, Slack, and SharePoint. While TruffleHog is a legitimate tool often used in CI pipelines and security assessments, its execution can also indicate malicious activity, as observed in campaigns like Shai-Hulud targeting npm packages to steal sensitive information. The rule triggers on the execution of 'trufflehog.exe' or when its command line arguments indicate searching specific platforms or verifying results.
This rule detects the execution of TruffleHog, a tool designed to find secrets in various platforms such as Git, GitHub, Jira, Slack, Confluence, SharePoint, Docker images, and cloud storage services like S3 and GCS. While TruffleHog is a legitimate tool often used in CI pipelines and security assessments, its execution can also indicate malicious activity, as observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information. The rule triggers on either the image name ending with '/trufflehog' or a combination of command-line arguments indicating its use to scan specific platforms and the '--results=verified' flag.
Detects the creation of the 'shai-hulud-workflow.yml' file, which is associated with the Shai Hulud worm. This worm targets the NPM supply chain and is designed to exfiltrate GitHub secrets. The rule specifically looks for the creation of this file within the '.github/workflows/' directory.
This rule detects attempts to search for JSON Web Tokens (JWTs) via command-line interface (CLI) tools. It specifically looks for common JWT header prefixes ('eyJ0eXAiOi' and 'eyJhbGciOi') within command-line arguments of tools like 'find', 'findstr', 'select-string', and 'strings'. Threat actors often search for these tokens to steal them for purposes such as lateral movement or privilege escalation, as JWTs are widely used for authentication and authorization in various applications and services (e.g., Microsoft 365, Azure, AWS, Google Cloud).
Detects .NET DLLs containing hardcoded Azure Storage Account credentials, such as access keys or SAS tokens. This technique was observed in the Axis Communications plugin for Autodesk Revit, where it could have enabled a supply chain attack.
The following analytic identifies instances where users may have mistakenly entered their passwords in the username field during authentication attempts. It detects this by analyzing failed authentication events with usernames longer than 7 characters and high Shannon entropy, followed by a successful authentication from the same source to the same destination. This activity is significant as it can indicate potential security risks, such as password exposure. If confirmed malicious, attackers could exploit this to gain unauthorized access, leading to potential data breaches or further compromise of the system.
This analytic identifies processes accessing Intelliform Storage Registry keys used by Internet Explorer, excluding legitimate Internet Explorer and dllhost processes. This activity is significant because it can indicate unauthorized access or manipulation of sensitive registry keys used for storing form data in Internet Explorer, potentially leading to data exfiltration, credential theft, or further system compromise.
Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously.
While it is a legitimate tool, intended for use in CI pipelines and security assessments,
It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.
While it is a legitimate tool, intended for use in CI pipelines and security assessments,
It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.
Detects potentially suspicious search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG".
JWT tokens are often used for access-tokens across various applications and services like Microsoft 365, Azure, AWS, Google Cloud, and others.
Threat actors may search for these tokens to steal them for lateral movement or privilege escalation.
JWT tokens are often used for access-tokens across various applications and services like Microsoft 365, Azure, AWS, Google Cloud, and others.
Threat actors may search for these tokens to steal them for lateral movement or privilege escalation.
Detects attempts to access the PowerShell console history file (ConsoleHost_history.txt) or retrieve its path. This activity can indicate an adversary attempting to gather plaintext credentials or perform reconnaissance on previously executed commands.
Detects the creation or modification of files with names suggesting they contain plaintext credentials, such as passwords or recovery codes. This is a common tactic used by threat actors to find and steal credentials for lateral movement and privilege escalation.
Detects potential access attempts to the PowerShell console history directly via history file (ConsoleHost_history.txt).
This can give access to plaintext passwords used in PowerShell commands or used for general reconnaissance.
This can give access to plaintext passwords used in PowerShell commands or used for general reconnaissance.
Detects Salesforce Object Query Language (SOQL) queries that may be attempting to access or exfiltrate sensitive credentials like passwords, API keys, or tokens stored within Salesforce objects. This activity was observed in the UNC6395 campaign where attackers targeted AWS keys, Snowflake tokens, and passwords.
Detects the execution of `findstr.exe` with both the `/s` (search subfolders) and `/i` (case-insensitive search) flags. Adversaries commonly use `findstr.exe` as a living-off-the-land binary (LOLBIN) to search for sensitive information, configuration files, or other interesting data within a compromised system, often filtering through command output or file contents.
Detects the creation of hidden configuration files used by the Odyssey Infostealer on macOS. These files are known to store sensitive data like passwords, C2 server details, and bot identifiers.
This analytic identifies processes accessing FileZilla XML configuration files (recentservers.xml and sitemanager.xml) by monitoring Windows Security Event Code 4663. This activity is considered unusual if not performed by the legitimate FileZilla application or OneDrive, and can indicate unauthorized access or manipulation of sensitive configuration files. Such access could lead to data exfiltration, credential theft, or further system compromise.
KQL Query from file: Monitor Azure API Secrets Extraction
KQL Query
KQL Query from file: Threat Intelligence Data from Sentinel UEBA2
Page 31 of 34