Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
38 detections
Filters
Last updated
All Time
Detection languages
25
5
3
2
2
Contributors
7
5
5
3
3
Categories
33
28
7
5
4
Platforms
23
9
6
3
3
Products / Services
13
9
8
5
3
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
3
IDS Protocols
3
Identifies rapid retrieval of dozens of secrets from Azure Key Vaults within minutes by a single identity. This behavior can indicate an attacker attempting to exfiltrate credentials or sensitive information after gaining initial access to an Azure environment.
This rule detects attempts to access secrets stored in Google Cloud Platform (GCP) Secret Manager via its API. It specifically looks for HTTP traffic directed to 'secretmanager.googleapis.com' with a URI path containing '/versions/' and ':access', indicating an attempt to access a specific secret version.
This rule detects attempts to retrieve secret values from AWS Secrets Manager. It specifically looks for HTTP requests to 'secretsmanager.amazonaws.com' containing 'GetSecretValue' in the URI. This activity could indicate an attacker attempting to access sensitive credentials.
This rule detects attempts to access secrets stored in Azure Key Vault via its API. It specifically looks for HTTP traffic where the host matches the Azure Key Vault domain pattern '*.vault.azure.net' and the URI contains '/secrets/'. This indicates a potential attempt to retrieve sensitive information.
This rule detects high-volume access to Azure Key Vault secrets, keys, or certificates within a one-hour window. It specifically looks for successful read operations on secrets, keys, and certificates, as well as modifications to access policies. A high volume (more than 10 accesses) from a single caller within an hour is flagged as potential credential harvesting.
This rule detects the use of Azure Managed Identity tokens originating from non-Azure IP spaces. This scenario is indicative of token theft, likely via the Instance Metadata Service (IMDS) endpoint (169.254.169.254), followed by an external replay of the stolen token from an attacker's infrastructure. Legitimate Managed Identity calls are expected to originate from Azure infrastructure IPs. The rule filters out legitimate Microsoft/Azure ASNs and RFC1918 private IP ranges to reduce false positives. It also categorizes the potential attack stage based on the operation name, including Key Vault access, Storage access, VM Code Execution, Privilege Escalation, and Directory Enumeration.
Detects the execution of a 'kubectl get secrets' command with specific parameters ('--all-namespaces', '-o json', '|| true') via a 'bash' process on Linux systems. This activity is indicative of bulk Kubernetes secret enumeration, a technique used by the TeamPCP stealer as described by Microsoft.
This rule detects high-volume access to Azure Key Vault secrets, keys, or certificates within a one-hour window. It specifically looks for successful read operations on secrets, keys, and certificates, as well as modifications to access policies. A high volume (more than 10 accesses) from a single caller within an hour is flagged as potential credential harvesting.
Detects the creation or modification of a GitHub Actions workflow file that attempts to exfiltrate secrets. This pattern is associated with the Shai-Hulud worm, which injects malicious workflows to steal credentials using `toJSON(secrets)` and exfiltrate them using tools like `curl` and `base64`.
KQL Query from file: Monitor Azure API Secrets Extraction
KQL Query
KQL Query from file: Mitigating security risks in MCP implementations
'This hunting query looks for queries that appear to be looking for secrets or passwords in tables.'
Added credential from country X and Signed-In from country Y in a pecific time window:
This query tries to find all applications that credentials were added to them from country X while the application's identity Signed-In from country Y in a specific time window.
This query tries to find all applications that credentials were added to them from country X while the application's identity Signed-In from country Y in a specific time window.
This rule identifies when a key within Azure Key Vault is modified or deleted. This includes operations such as updating, creating, importing, recovering, restoring, deleting, backing up, or purging keys. Monitoring these actions is crucial as compromise or unauthorized modification/deletion of cryptographic keys can lead to significant security incidents, including data compromise, loss of access to encrypted resources, or disruption of services relying on these keys.
This rule identifies when secrets stored in Azure Key Vaults are modified or deleted. It specifically looks for operations such as writing, deleting, backing up, purging, updating, recovering, restoring, or setting secrets within Azure Key Vaults. This activity can indicate unauthorized access to sensitive credentials or an attempt to disrupt services by removing critical secrets.
This rule identifies when Kubernetes secrets are modified or deleted within a Google Cloud Platform (GCP) environment. It specifically looks for audit log entries related to the creation, update, patch, or deletion of Kubernetes secrets.
Page 2 of 2