Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,613 detections
Filters
Last updated
All Time
Detection languages
1,725
690
264
214
190
Contributors
985
505
494
256
209
Categories
814
787
728
629
473
Platforms
2,069
629
488
459
346
Products / Services
769
666
525
193
185
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
3,613
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
This rule detects suspicious activity related to input capturing, keylogging, or credential access, specifically looking for corresponding 'ActionType' events in Microsoft Defender for Endpoint (DeviceEvents) logs. It alerts on processes performing these actions on devices.
Detects scenarios where a user's password is reset or sessions are revoked in Azure Active Directory, followed closely by mailbox access (items accessed, sent, or deleted) from a client IP address that was never seen interacting with that mailbox prior to the password reset event.
Detects established git actors (seen >7 days ago) originating from a newly observed source IP address (first seen within 24 hours) that perform a high volume of git operations (>=15) across multiple distinct repositories (>=10). This behavior often indicates compromised developer credentials being used to enumerate and clone source code repositories.
The following analytic detects the creation of open/public S3 buckets via the AWS CLI.
It leverages AWS CloudTrail logs to identify events where a user has set bucket permissions to allow access to "AuthenticatedUsers" or "AllUsers." This activity is significant because open S3 buckets can expose sensitive data to unauthorized users, leading to data breaches.
If confirmed malicious, an attacker could gain unauthorized access to potentially sensitive information stored in the S3 bucket, posing a significant security risk.
It leverages AWS CloudTrail logs to identify events where a user has set bucket permissions to allow access to "AuthenticatedUsers" or "AllUsers." This activity is significant because open S3 buckets can expose sensitive data to unauthorized users, leading to data breaches.
If confirmed malicious, an attacker could gain unauthorized access to potentially sensitive information stored in the S3 bucket, posing a significant security risk.
Detects when a dialog user reads a restricted SAP table using generic table browser transactions such as SE11, SE16, or SE16N.
The following analytic detects a process loading the credui.dll or wincredui.dll module. This detection leverages Sysmon EventCode 7 to identify instances where these DLLs are loaded by processes outside typical system directories. This activity is significant because adversaries often abuse these modules to create fake credential prompts or dump credentials, posing a risk of credential theft. If confirmed malicious, this activity could allow attackers to harvest user credentials, leading to unauthorized access and potential lateral movement within the network.
This rule monitors for the addition of new credentials (secrets) to service principals or applications in an Azure/Entra ID environment. It then correlates this event with subsequent mailbox activity (such as accessing mail items, sending mail, or message binding) performed by the application within 7 days of the credential creation. This detection pattern is indicative of potential OAuth application-based persistence and mailbox data exfiltration.
Detects network activity associated with the TA419 threat group's 'Frameless' Browser-in-the-Browser (BitB) Adversary-in-the-Middle (AitM) phishing campaign. The rules identify unauthorized OAuth2 authorization requests to non-Microsoft hosts that match known malicious client IDs, the delivery of BitB overlay scripts, and the subsequent execution of malicious scripts correlated with OneDrive-themed lookalike redirects, indicating a credential theft attempt.
Unsigned LDAP Bind
Cortex XDR
Detects Lightweight Directory Access Protocol (LDAP) binds that are performed without signing or encryption. Attack tools such as NetExec, ldapdomaindump, and Impacket frequently use simple, unencrypted LDAP binds over port 389, which can result in the transmission of credentials in cleartext. This rule monitors Windows Event ID 2889 on Domain Controllers, which logs cleartext LDAP bind attempts.
Detects network activity associated with the TA419 threat group's 'Frameless' Browser-in-the-Browser (BitB) Adversary-in-the-Middle (AitM) phishing campaign. The rules identify unauthorized OAuth2 authorization requests to non-Microsoft hosts that match known malicious client IDs, the delivery of BitB overlay scripts, and the subsequent execution of malicious scripts correlated with OneDrive-themed lookalike redirects, indicating a credential theft attempt.
Detects sign-in activity originating from a known suspicious VPN/proxy IP range targeting critical Microsoft 365 applications. The rule specifically monitors for instances where multi-factor authentication (MFA) enforcement appears to be absent or failed, suggesting a potential account compromise and subsequent data access attempt via a proxy/VPN.
This rule detects the installation of browser extensions that request highly sensitive, over-broad permissions such as proxy configuration management and web authentication provider access, combined with full host access (<all_urls>). This pattern is often indicative of malicious extensions masquerading as legitimate tools (e.g., VPNs) to facilitate credential theft or traffic interception.
The following analytic detects the use of the Linux 'xclip' command to copy data from the clipboard. It leverages Linux Auditd telemetry, focusing on process names and command-line arguments related to clipboard operations. This activity is significant because adversaries can exploit clipboard data to capture sensitive information such as passwords or IP addresses. If confirmed malicious, this technique could lead to unauthorized data exfiltration, compromising sensitive information and potentially aiding further attacks within the environment.
The following analytic detects the use of the Linux 'xclip' command to copy data from the clipboard. It leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and command-line arguments related to clipboard operations. This activity is significant because adversaries can exploit clipboard data to capture sensitive information such as passwords or IP addresses. If confirmed malicious, this technique could lead to unauthorized data exfiltration, compromising sensitive information and potentially aiding further attacks within the environment.
This detection identifies potentially suspicious usage of sqlcmd.exe, focusing on command patterns that may indicate data exfiltration, reconnaissance, or malicious database operations. The detection looks for both short-form (-X) and long-form (--flag) suspicious parameter combinations, which have been observed in APT campaigns targeting high-value organizations. For example, threat actors like CL-STA-0048 have been known to abuse sqlcmd.exe for data theft and exfiltration from compromised MSSQL servers. The detection monitors for suspicious authentication attempts, output redirection, and potentially malicious query patterns that could indicate unauthorized database access or data theft.
Detects high-volume retrieval of secrets by a single principal within a one-hour window across AWS Secrets Manager, Azure Key Vault, and Google Cloud Secret Manager. This behavior is indicative of bulk credential harvesting or automated sensitive data exfiltration following unauthorized access or privilege escalation in cloud environments.
Detects network activity associated with the TA419 threat group's 'Frameless' Browser-in-the-Browser (BitB) Adversary-in-the-Middle (AitM) phishing campaign. The rules identify unauthorized OAuth2 authorization requests to non-Microsoft hosts that match known malicious client IDs, the delivery of BitB overlay scripts, and the subsequent execution of malicious scripts correlated with OneDrive-themed lookalike redirects, indicating a credential theft attempt.
Detects browser extension updates that request a combination of high-risk permissions capable of account takeover (e.g., cookies, webRequest, identity) for extensions previously classified as low-risk. This pattern often indicates a supply chain compromise where a benign extension is acquired and subsequently updated with malicious capabilities.
Detects network activity associated with the TA419 threat group's 'Frameless' Browser-in-the-Browser (BitB) Adversary-in-the-Middle (AitM) phishing campaign. The rules identify unauthorized OAuth2 authorization requests to non-Microsoft hosts that match known malicious client IDs, the delivery of BitB overlay scripts, and the subsequent execution of malicious scripts correlated with OneDrive-themed lookalike redirects, indicating a credential theft attempt.
This rule detects potential Browser-in-the-Browser (BitB) phishing attacks by identifying suspicious browser pop-up behavior (using window.open flags, hidden address/toolbars) on non-identity-provider domains, followed shortly by credential submission patterns on the same device. This pattern mimics legitimate OAuth or SSO windows to harvest user credentials.
Detects unauthorized process activity that reads, copies, archives, or transmits the NetScaler ns.conf configuration file. This file contains highly sensitive information, including AAA/LDAP bind credentials and certificates. Adversaries may stage or exfiltrate this file following the exploitation of vulnerabilities (such as CVE-2026-88771 or CVE-2026-88772) on NetScaler appliances to facilitate further network compromise.
Page 3 of 173