Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
339 detections
Filters
Last updated
All Time
Detection languages
120
95
28
25
18
Contributors
111
38
29
22
22
Categories
227
127
107
45
27
Platforms
254
58
57
11
10
Products / Services
76
70
29
21
17
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
2
2
1
1
1
IDS Classtypes
7
1
IDS Protocols
8
Detects the execution of a browser process with the remote debugging port argument enabled. This technique is used by infostealers like Stealerium and Phantom Stealer to bypass browser security and steal credentials and cookies.
Detects processes accessing sensitive browser files which may indicate credential theft from web browsers.
Detects scenarios where an attacker attempt to dump user profile information via network share.
This detection rule uses a WDAC audit policy to ingest missing DeviceImageLoad events in MDE, and check for suspicious processes using the ncrypt.dll and requesting an Entra ID Nonce. More information on the attack scenario this is detection is applicable for can be found in the references.
Detects the execution of an AppleScript, characteristic of the Odyssey Stealer, that displays a dialog box prompting the user for their password.
Detects when a process loads UIAutomationCore.dll, which may indicate abuse of Microsoft's UI Automation framework. This technique has been observed in Coyote malware for credential theft from banking applications and cryptocurrency exchanges. The rule monitors for processes that load the UI Automation Core library, which enables automated interaction with UI elements.
The following analytic identifies command-line activity that searches for files related to password manager software, such as "*.kdbx*" and "*credential*". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant because attackers often target password manager databases to extract stored credentials, which can be used for further exploitation. If confirmed malicious, this behavior could lead to unauthorized access to sensitive information, enabling attackers to escalate privileges, move laterally, or exfiltrate critical data.
Detects known samples of the Katz Stealer infostealer based on their SHA1 file hashes.
KQL Query from file: T1555.003 - Credentials from Web Browsers
Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
Detects a suspicious process pattern which could be a sign of an exploited Serv-U service
'Looks for users retrieving BitLocker keys. Enriches these logs with a summary of alerts associated with the user accessing the keys.
Use this query to start looking for anomalous patterns of key retrieval.
Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-devices#bitlocker-key-retrieval'
Use this query to start looking for anomalous patterns of key retrieval.
Ref: https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-devices#bitlocker-key-retrieval'
Search for accessing of fake files with stored credentials
Adversaries may search for common password storage locations to obtain user credentials.
Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.
Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.
Detects the execution of SecurityXploded Tools
Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.
Detects the execution of SecurityXploded Tools
Detects a suspicious process pattern which could be a sign of an exploited Serv-U service
Adversaries may search for common password storage locations to obtain user credentials.
Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.
Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.
Page 15 of 17