Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
707 detections
Filters
Last updated
All Time
Detection languages
362
144
48
42
25
Contributors
209
170
72
54
41
Categories
485
297
189
112
77
Platforms
413
316
165
62
53
Products / Services
162
112
62
36
34
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
707
CVEs
5
5
4
3
2
IDS Classtypes
15
5
4
2
IDS Protocols
24
2
1
'This hunting query uses Application events from the "MSSQL$MICROSOFT##WID" provider to collect SQL statements run against an AD FS database (e.g Windows Internal Database (WID)).
A threat actor might want to extract the AD FS data configuration settings with a SQL statement or modify it with an UPDATE SQL statement.
In order to use this query you need to create a server audit and database audit specification on your AD FS database.
Reference: https://github.com/Azure/SimuLand/blob/main/3_simulate_detect/credential-access/exportADFSTokenSigningCertificate.md
Reference: https://o365blog.com/post/adfs/
'
A threat actor might want to extract the AD FS data configuration settings with a SQL statement or modify it with an UPDATE SQL statement.
In order to use this query you need to create a server audit and database audit specification on your AD FS database.
Reference: https://github.com/Azure/SimuLand/blob/main/3_simulate_detect/credential-access/exportADFSTokenSigningCertificate.md
Reference: https://o365blog.com/post/adfs/
'
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
These can be files created by users to store their own credentials, shared credential stores for a group of individuals,
configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
These can be files created by users to store their own credentials, shared credential stores for a group of individuals,
configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Detects Russian group activity as described in Global Threat Report 2019 by Crowdstrike
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.
Detects files written by the different tools that exploit HiveNightmare
ZLoader was delivered in a campaign in late summer 2021. This campaign was tweeted by @MsftSecIntel on twitter.
This rule detects attempts by uncommon applications to access cryptocurrency wallet files. It specifically looks for file access requests to common cryptocurrency wallet paths for Ethereum, Ethereum Classic, Monero, Bitcoin, BitcoinABC, BitcoinSV, DashCore, DogeCoin, Litecoin, Ripple, and Zcash. The rule filters out access by common system processes, applications installed in standard Program Files directories, and Windows Defender components to reduce false positives. This activity could indicate an attempt to steal cryptocurrency wallets.
Detects attempts to access the "unattend.xml" file, which can contain sensitive credentials used during the unattended Windows installation process. Attackers may target this file to harvest credentials.
This rule detects when Single Sign-On (SSO) recovery codes are accessed (downloaded, generated, printed, or viewed) for a GitHub enterprise or organization. Adversaries may attempt to access or steal these recovery codes to maintain persistent access to the target's GitHub environment, bypassing normal authentication mechanisms.
Detects command-line keywords indicative of the execution of the WinPwn tool, which is used for Windows and Active Directory reconnaissance and exploitation. This rule specifically looks for 'Offline_Winpwn', 'WinPwn ', 'WinPwn.exe', or 'WinPwn.ps1' in the command line.
Detects scriptblock text keywords indicative of potential usage of the tool WinPwn. WinPwn is a tool for Windows and Active Directory reconnaissance and exploitation. The rule specifically looks for 'Offline_Winpwn', 'WinPwn ', 'WinPwn.exe', or 'WinPwn.ps1' within PowerShell script block logs.
This rule detects attempts to extract passwords from files on Linux systems using the 'grep' command. It specifically looks for executions of 'grep' in conjunction with the keyword 'password', indicating a potential search for credentials.
This rule detects attempts to copy the 'passwd' or 'shadow' files from the '/tmp/' directory using the 'cp' command. This activity is highly suspicious as these files contain sensitive user account information, including password hashes (in the case of 'shadow'), and should not typically be copied to temporary directories. An adversary might do this to exfiltrate credentials for offline cracking or to move them to a location accessible for further exploitation.
This rule identifies when an Azure Key Vault is modified or deleted. Key Vaults store sensitive information such as cryptographic keys, certificates, and secrets. Unauthorized modification or deletion of a Key Vault could indicate an attacker attempting to disrupt services, remove evidence, or gain access to sensitive credentials. The rule specifically looks for operations related to writing, deleting, deploying, or modifying access policies of Key Vaults.
This rule detects command-line patterns indicative of reconnaissance activities on Linux systems, specifically searching for '.htpasswd' files which often contain credentials, and files with SUID/SGID permissions ('-perm -4000') which can be exploited for privilege escalation. These commands are commonly used by attackers to gather information about the system's configuration and potential credential storage locations.
This rule detects command-line patterns associated with potential Russian APT credential theft activities, specifically targeting Active Directory data. It looks for the use of `xcopy` to copy the `sysvol` directory, which can contain sensitive information, and `adexplorer` to create a snapshot of Active Directory data, typically saved as a `.snp` file in a user's downloads directory. These actions are indicative of adversaries attempting to exfiltrate or analyze Active Directory credentials and configuration.
Detects attempts to extract credentials from files using the 'grep' command to search for the keyword 'password' or by executing the 'laZagne' credential dumping tool. This rule is specifically tailored for macOS environments.
This rule detects commands commonly used on Cisco network devices to collect configuration data, which may contain sensitive information such as credentials. The commands include 'show running-config' to display the current operational configuration, 'show startup-config' to display the configuration loaded at boot, and 'show archive config' which can show archived configurations. An adversary might use these commands to gather information about the network, discover credentials, or understand the device's security posture.
Detects command line usage of "findstr.exe" to search for keywords related to "passwords" in various languages. This activity can indicate an adversary attempting to locate credentials stored in files on a compromised system.
This rule detects the creation of files with specific naming conventions that are indicative of tools exploiting the HiveNightmare (CVE-2021-36934) vulnerability to export the Security Account Manager (SAM) database. The rule looks for various file names and patterns used by different implementations of HiveNightmare exploitation tools, including those written in Go, C++, PowerShell, and C#.
Page 33 of 34