Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,809 detections
Filters
Last updated
All Time
Detection languages
1,679
1,539
487
304
268
Contributors
834
780
764
414
306
Categories
2,349
1,140
626
566
516
Platforms
3,100
699
579
382
322
Products / Services
855
812
565
421
322
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
4,809
CVEs
17
9
8
6
6
IDS Classtypes
89
56
15
14
8
IDS Protocols
101
81
9
7
1
Detects command line parameters used by Hydra password guessing hack tool
Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.
Indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns
Detects when the file "passwd" or "shadow" is copied from tmp path
Detects the usage of tooling to sniff network traffic.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Detects commandline operations on shell history files
Detect standard users login that are part of high privileged groups such as the Administrator group
NTLM Brute Force
Sigma
Detects common NTLM brute force device names
Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity
Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.
Identifies when a key vault is modified or deleted.
End User Consent
Sigma
Detects when an end user consents to an application
Detects when end user consent is blocked due to risk-based consent.
Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD
Indicates access attempt to the PRT resource which can be used to move laterally into an organization or perform credential theft
Detects the creation or patching of potential malicious RoleBinding. This includes RoleBindings and ClusterRoleBinding.
Identifies when the Secrets are Modified or Deleted.
Cisco Collect Data
Sigma
Collect pertinent data from the configuration files
Transferring files with well-known filenames (sensitive files with credential data) using network shares
Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting
Detects tools extracting LSA secret DPAPI domain backup key from Domain Controllers
Page 223 of 229