Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,046 detections
Filters
Last updated
All Time
Detection languages
23,955
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,590
11,933
5,910
5,194
4,872
Platforms
40,154
7,369
6,547
3,915
3,692
Products / Services
10,809
9,795
6,757
4,421
3,771
MITRE Techniques
18,176
15,735
12,661
8,477
6,293
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
Details: Detects suspicious credential access activity when a single parent process on a host spawns multiple child processes whose command lines reference at least 3 unique credential-store categories within a 15-minute window. Aligns with Team PCP stealer behaviour analysed as part of the open source Shai-Hulud framework.
Hypothesis: An adversary is harvesting credentials by rapidly enumerating multiple distinct credential stores through commands spawned from a common parent process.
Actions: Due to how the query is structured and resource limitations in the collect() function, it is necessary to manually pivot from the detection summary into the host process telemetry and investigate the initiating process (ParentProcessID), the child processes (TargetProcessID) as well as the file names and command lines. The parent process is the most crucial aspect to consider when investigating this detection, and particular attention should be placed on unrecognised Python scripts which may indicate broader credential harvesting activity (see references).
References: https://securitylabs.datadoghq.com/articles/shai-hulud-open-source-framework-static-analysis/#filesystem-scanning, https://www.crowdstrike.com/en-us/blog/from-scanner-to-stealer-inside-the-trivy-action-supply-chain-compromise/
**Any suggestions for improvements welcome**
Hypothesis: An adversary is harvesting credentials by rapidly enumerating multiple distinct credential stores through commands spawned from a common parent process.
Actions: Due to how the query is structured and resource limitations in the collect() function, it is necessary to manually pivot from the detection summary into the host process telemetry and investigate the initiating process (ParentProcessID), the child processes (TargetProcessID) as well as the file names and command lines. The parent process is the most crucial aspect to consider when investigating this detection, and particular attention should be placed on unrecognised Python scripts which may indicate broader credential harvesting activity (see references).
References: https://securitylabs.datadoghq.com/articles/shai-hulud-open-source-framework-static-analysis/#filesystem-scanning, https://www.crowdstrike.com/en-us/blog/from-scanner-to-stealer-inside-the-trivy-action-supply-chain-compromise/
**Any suggestions for improvements welcome**
Detects an unsigned or suspicious process touching multiple credential or session stores (such as browsers, mail clients, chat applications, SSH keys, and cloud/VPN configurations) across different categories within a short time window, indicative of infostealer or credential harvesting activity.
Detects a Microsoft Office application loading taskschd.dll, which exposes COM interfaces for managing Windows Scheduled Tasks.
This load is an early precursor to scheduled task creation or modification and has been frequently observed in macro-enabled
malicious documents attempting to establish persistence.
This load is an early precursor to scheduled task creation or modification and has been frequently observed in macro-enabled
malicious documents attempting to establish persistence.
Hunts Entra ID service principal sign-ins that match reported stolen app credential abuse against MSP and customer tenants: the reported operator IP and client strings, an invalid secret followed by a successful sign-in from the same IP and apps that sign in for the first time in the window. It matches reported indicators only, so other infrastructure is not covered.
Detects Linux process creation where a shell script or command downloads a hidden binary named .b using wget or curl, changes its permissions to executable, and executes it in the background, matching behavior typical of the Mirai malware l.sh dropper.
Detects bulk web requests originating from the ARTEX AI framework user agents ('artex-enrich/1.0' and 'norma/0.4'). These requests are aggregated by source IP and destination hostname to identify heavy activity such as automated scanning or content enrichment.
Detects a root shell (sh, dash, or bash) spawned as a child process of an ARTEX application process, which is consistent with exploitation or backdoored login handlers passing command execution remainders to a shell.
The following analytic detects instances where Java, or Tomcat processes spawn a Linux shell, which may indicate exploitation attempts, such as those related to CVE-2021-44228 (Log4Shell).
This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and parent-child process relationships.
This activity is significant as it can signify a compromised Java application, potentially leading to unauthorized shell access.
If confirmed malicious, attackers could execute arbitrary commands, escalate privileges, or maintain persistent access, posing a severe threat to the environment.
This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and parent-child process relationships.
This activity is significant as it can signify a compromised Java application, potentially leading to unauthorized shell access.
If confirmed malicious, attackers could execute arbitrary commands, escalate privileges, or maintain persistent access, posing a severe threat to the environment.
Detects behavior associated with the Bitter APT group where system reconnaissance commands are executed via command shells (powershell, cmd), staged into a local file named 'abc.pdf' using output redirection, and subsequently uploaded/exfiltrated using curl within a 30-minute window.
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
Detects Node-RED admin API flow deployments (POST /flows) where the payload contains an 'http in' node, a 'function' node, an 'exec' node, and 'addpay' enabled, which can indicate malicious workflow deployment or command execution attempts.
Detects a suspicious sequence of events in GitHub where a temporary branch matching a specific pattern (ci-tmp-<hex>) is created or pushed, and subsequently deleted along with associated workflow runs in the same repository within a short time window.
Detects suspicious commands executed via the Windows Run dialog (Win+R) by correlating RunMRU registry updates with the originating process. This hunt is intended to identify user-driven execution techniques commonly observed in ClickFix, FileFix, fake CAPTCHA, and other social engineering attacks.
This analytic detects HTTP POST requests with a body of at least one megabyte that receive an HTTP 500 response.
Large failed uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
Large failed uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
Detects execution of tunneling, proxy, and remote exposure tools associated with unauthorized access and protocol tunneling and web sockets.
Detects execution of the Nmap scanning tool initiated by script interpreters, shells, or container runtimes, coupled with network behavior indicating a fan-out of connections to multiple distinct hosts or ports.
This analytic correlates Apache and Nginx access and error logs when "multipart/form-data" requests and PHP memory-limit exhaustion errors occur for the same PID, host, and client.
It extracts web request details and "PHP" error messages to support investigation of possible PHP2Shell exploitation attempts.
It extracts web request details and "PHP" error messages to support investigation of possible PHP2Shell exploitation attempts.
Correlates a successful Entra ID sign-in from an unmanaged device/IP with a persistence action (such as OAuth consent, app permission grant, or device registration) performed by the same user from a different IP within 1 hour. This behavior is indicative of post-AiTM or device-code session hijacking where stolen tokens are replayed from attacker infrastructure.
https://admin.cloud.microsoft/?ref=MessageCenter/:/messages/MC1532241
https://remedio.io/research/vulnerability-disclosures/remote-code-execution-in-teamviewer/
Hunt: Entra sign-ins from the operator IP, or with the two client fingerprints Todyl reports as unique to this actor. These are the highest-confidence indicators in the campaign, so a successful hit means a stolen app secret worked in your tenant.
The low-confidence spray IPs are off by default; enable them only for hunting, since a hit there indicates targeting, not compromise.
The low-confidence spray IPs are off by default; enable them only for hunting, since a hit there indicates targeting, not compromise.
Page 2 of 2907