Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
170 detections
Filters
Last updated
All Time
Detection languages
64
46
20
18
12
Contributors
36
23
19
13
12
Categories
59
42
39
38
36
Platforms
74
43
24
22
18
Products / Services
42
36
33
13
10
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
7
2
2
2
1
IDS Classtypes
4
4
3
3
1
IDS Protocols
7
5
Detects new-device passkey bootstrap via PRF exchange and encrypted passkey download correlated with an anomalous signal (no prior authentication history on the device, new geolocation/ASN, or missing user-presence confirmation on the trusted device), consistent with an attacker abusing the one-time cross-device sync bootstrap flow to sync a victim's passkeys to an attacker-controlled device.
Detects the Silver Pass-ta-key attack chain where a device or UV key registration event (device/register, keys/genpair, device/add_uv_key) on the cloud authenticator is followed within a short window by a successful login to a high-value account from a device with no prior authentication history. To reduce false positives from legitimate device enrollment-then-use, the rule additionally requires either that the registration lacked an expected attestation/biometric ceremony, or that the subsequent login originated from a geolocation/ASN inconsistent with the user's normal authentication pattern, consistent with fully automated authentication using an attacker-registered UV key without human interaction.
Detects XCSSET resetting the TCC AppleEvents permission database via tccutil resetAppleEvents correlated with a subsequent fake System Settings/Xcode consent prompt, excluding known MDM tooling.
Detects XCSSET resetting the TCC AppleEvents permission database via tccutil resetAppleEvents correlated with a subsequent fake System Settings/Xcode consent prompt, excluding known MDM tooling.
Detects trojanized Finder/Xcode/Terminal/Reminders/SimulatorTrampoline application bundles located outside their standard system paths with ad-hoc or invalid code signatures, used to misuse and reset TCC permissions.
Detects trojanized Finder/Xcode/Terminal/Reminders/SimulatorTrampoline application bundles located outside their standard system paths with ad-hoc or invalid code signatures, used to misuse and reset TCC permissions.
Detects anomalous SOAP requests to 'GetScratchCodesRequest' within the 'zimbraSync' or 'zimbraAccount' namespaces in Zimbra logs. This activity is indicative of credential harvesting attempts, specifically the exfiltration of 2FA recovery scratch codes, often associated with the ZimReaper/Ulej payload used by threat actors.
Detects successful non-interactive sign-ins to Azure CLI using the Resource Owner Password Credentials (ROPC) flow where Conditional Access policies failed to enforce multi-factor authentication (MFA). This typically indicates misconfigured Conditional Access policies, such as exclusions for non-interactive authentication methods or service accounts, which could be exploited by adversaries to bypass MFA.
Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.
Detects unauthorized file write or rename operations targeting core OpenSSH binary and library paths, excluding known package manager activities. This behavior is indicative of an adversary replacing legitimate system binaries to create a trojanized version of OpenSSH, as observed in the Velvet Ant 'Operation Highland' campaign, used to harvest credentials and log SSH sessions.
Detects Kerberos AS-REQ (Event 4768) using certificate-based pre-authentication (PKINIT / PA-PK-AS-REQ) with AES256 encryption. This represents the second stage of a Shadow Credentials attack, where an adversary authenticates using a rogue key credential they previously wrote to msDS-KeyCredentialLink. The rule filters out legitimate PKI-issued certificates from specified CAs and computer accounts.
Detects Event 5136 where msDS-KeyCredentialLink is added to an AD object, indicative of Shadow Credentials abuse via Whisker/DSInternals. The rule filters out MSOL_ sync accounts and computer-to-computer self-writes to reduce false positives.
Detects behavior indicative of the AMOS (Atomic macOS) infostealer, where a malicious process uses 'osascript' to display a fake System Preferences password prompt to the user and then attempts to validate the harvested credentials using 'dscl -authonly'.
Detects session hijacking consistent with Browser-in-the-Middle (BitM) attacks like Bluekit PhaaS, where an attacker captures an authenticated session token. The rule identifies instances where a successful MFA-protected login event is immediately followed by a session reuse event from a different IP address or network location, which is indicative of the attacker utilizing the intercepted session.
Detects the deletion of a phishing-resistant authentication method (like FIDO2 security key or passkey) followed by the registration of a weaker authentication method (like a phone authentication method or software OATH token) for the same account. This pattern indicates a potential downgrade attack on an account's authentication security.
Detects the use of osascript to spawn fake macOS system dialogs that mimic legitimate 'System Preferences' prompts to harvest user login passwords. This activity often involves AppleScript dialog commands combined with dscl authonly checks to validate the stolen credentials.
Detects the registration of a new authentication method (phone, authenticator app, passkey, or security key) in Azure Active Directory after a session exhibits unusual location or token behavior, indicated by a high or medium risk level, anonymous proxy usage, or unfamiliar features.
Detects Python executing a web-administration exploit with valid credential input and explicit two-factor bypass logic, matching the AI-assisted semantic trust-flaw exploitation described by GTIG.
Detects deletion of a phishing-resistant authentication method followed by registration of a less secure phone or software token method for the same account.
Detects removal of registered authentication methods shortly after a password reset, a sequence that can prevent the legitimate user from recovering the account. This rule specifically looks for successful 'Delete user authentication method' or 'Remove authentication method' operations in AuditLogs.
Detects an SSPR (Self-Service Password Reset) event immediately followed by the registration of a new Microsoft Authenticator method for the same user. This sequence of events can indicate an attacker has compromised an identity, performed a password reset, and is attempting to establish a new MFA method for persistent access.
Page 4 of 9