Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,809 detections
Filters
Last updated
All Time
Detection languages
1,679
1,539
487
304
268
Contributors
834
780
764
414
306
Categories
2,349
1,140
626
566
516
Platforms
3,100
699
579
382
322
Products / Services
855
812
565
421
322
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
4,809
CVEs
17
9
8
6
6
IDS Classtypes
89
56
15
14
8
IDS Protocols
101
81
9
7
1
Anomalous Token
Sigma
Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location.
Anonymous IP Address
Sigma
Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.
Account Lockout
Sigma
Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.
Detects suspicious session with two users present
Detects events with patterns found in commands used for reconnaissance on linux systems
Detects passwords dumps from Keychain
Credentials In Files
Sigma
Detecting attempts to extract passwords with grep and laZagne
Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels.
Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access.
Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access.
Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml
Ntdsutil Abuse
Sigma
Detects potential abuse of ntdsutil to dump ntds.dit database
Detects when an application acquires a certificate private key
Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store.
Detects certificate creation with template allowing risk permission subject
Detects certificate creation with template allowing risk permission subject and risky EKU
Detect AD credential dumping using impacket secretdump HKTL
Detect PetitPotam coerced authentication activity.
Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to the client
Detects failed Kerberos TGT issue operation. This can be a sign of manipulations of TGT messages by an attacker.
Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN
Detects service ticket requests using RC4 encryption type
Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.
Page 225 of 229