Browse Rules

AWS EC2 Many Password Read Attempts

An actor in AWS has made many attempts to retrieve EC2 passwords. It is typically not necessary to retrieve EC2 passwords more than a few times an hour.

Unusual 1Password Client Detected

Detects when unusual or undesirable 1Password clients access your 1Password account

Linux Auditd Find Credentials From Password Stores

The following analytic detects suspicious attempts to find credentials stored in password stores, indicating a potential attacker's effort to access sensitive login information. Password stores are critical repositories that contain valuable credentials, and unauthorized access to them can lead to significant security breaches. By monitoring for unusual or unauthorized activities related to password store access, this analytic helps identify potential credential theft attempts, allowing security

Azure Key Vault Certificate Accessed

Detects when Azure Key Vault certificates are accessed via read operations. Adversaries may attempt to dump certificates to extract credentials for service principals or establish persistence through certificate-based authentication.

Azure Key Vault Secret Accessed or Recovered

Detects when Azure Key Vault secrets are accessed or when soft-deleted secrets are recovered. Recovering soft-deleted secrets may indicate an attacker attempting to extract previously deleted credentials.

Linux Auditd Find Credentials From Password Managers

The following analytic detects suspicious attempts to find credentials stored in password managers, which may indicate an attacker's effort to retrieve sensitive login information. Password managers are often targeted by adversaries seeking to access stored passwords for further compromise or lateral movement within a network. By monitoring for unusual or unauthorized access to password manager files or processes, this analytic helps identify potential credential theft attempts, enabling securit

AWS Decrypt SSM Parameters

Identify principals retrieving a high number of SSM Parameters of type 'SecretString'. This rule filters out known administrative roles that legitimately need bulk parameter access.

Web Browser Credential Access via Scripting Utility

Identifies an unexpected process accessing the password store of commonly used web browsers. Adversaries may steal credentials from web browsers by reading files specific to the target browser.

Web Browser Credential Access via Unsigned Process

Identifies an unsigned process accessing the password store of commonly used web browsers. Adversaries may steal credentials from web browsers by reading files specific to the target browser.

Okta SWA Bulk Access, New Source, and Credential Extraction - Behavioral

Detects Okta SWA (Secure Web Authentication) bulk credential extraction, abuse, and access from previously unseen IP addresses or user agents using behavioral z-score and source novelty analysis. SWA apps store credentials in Okta's encrypted vault. Admin accounts with SWA access can view or rotate credentials for users across many apps. This detection builds a 90-day behavioral baseline for each admin's SWA access, credential change patterns, and known source IPs/user agents, then identifies a

Access to Browser Login Data

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store.

Access to Browser Login Data

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store.

Web Browser Credential Data Accessed by Unsigned or Untrusted Process

Identifies an unsigned process accessing the password store of commonly used web browsers. Adversaries may steal credentials from web browsers by reading files specific to the target browser.

Crowdstrike Credential Dumping Tool

Detects execution of credential dumping tools like Mimikatz, ProcDump, and Lazagne that extract passwords, hashes, and Kerberos tickets from memory and credential stores. These tools enable lateral movement, privilege escalation, and persistent access by allowing attackers to authenticate as legitimate users. This detection identifies a critical attack phase where adversaries transition from initial compromise to broader network access.

Okta SWA Off-Hours Credential Access - Behavioral

Detects Okta SWA credential access occurring outside normal business hours using behavioral z-score analysis on temporal patterns. Compromised admin accounts often access SWA credentials at unusual times - late at night, during weekends, or from a different geographic location than normal. This detection builds a 90-day baseline for each admin's temporal credential access patterns, then identifies anomalous shifts toward off-hours, late-night, and weekend activity in the last 7 days. **Detecti

Windows Credentials from Password Stores Chrome Login Data Access

The following analytic identifies non-Chrome processes accessing the Chrome user data file "login data." This file is an SQLite database containing sensitive information, including saved passwords. The detection leverages Windows Security Event logs, specifically event code 4663, to monitor access attempts. This activity is significant as it may indicate attempts by threat actors to extract and decrypt stored passwords, posing a risk to user credentials. If confirmed malicious, attackers could g

Windows Credentials from Password Stores Chrome Extension Access

The following analytic detects non-Chrome processes attempting to access the Chrome extensions file. It leverages Windows Security Event logs, specifically event code 4663, to identify this behavior. This activity is significant because adversaries may exploit this file to extract sensitive information from the Chrome browser, posing a security risk. If confirmed malicious, this could lead to unauthorized access to stored credentials and other sensitive data, potentially compromising the securit

Windows Credentials from Password Stores Creation

The following analytic detects the execution of the Windows OS tool cmdkey.exe, which is used to create stored usernames, passwords, or credentials. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant because cmdkey.exe is often abused by post-exploitation tools and malware, such as Darkgate, to gain unauthorized access. If confirmed malicious, this behavior could allow attack

Windows Password Managers Discovery

The following analytic identifies command-line activity that searches for files related to password manager software, such as "*.kdbx*" and "*credential*". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant because attackers often target password manager databases to extract stored credentials, which can be used for further exploitation. If confirmed malicious, this behavior could lead to unauthorized access to se

Credentials in Files & Registry

Adversaries may search the Windows Registry on compromised systems for insecurely stored credentials for credential access. This can be accomplished using the query functionality of the reg.exe system utility, by looking for keys and values that contain strings such as "password". In addition, adversaries may use toolkits such as [PowerSploit](https://powersploit.readthedocs.io/en/latest/) in order to dump credentials from various applications such as IIS.Accordingly, this analytic looks for inv

Keychain Export - MacOS [splunk-edr]

Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. Keychains can be viewed and edited through the Keychain Access application or using the command-line utility security. This use case detects commands used to access, dump, or export information from keychains. Atomics T1555.001 Test #1

Azure Key Vault Key Accessed or Recovered

Detects when Azure Key Vault cryptographic keys are accessed via read operations or recovered/restored. Key Vault keys contain public key information used for encryption, decryption, and signing operations. While private keys cannot be directly exported from Key Vault, adversaries may access key metadata and properties to understand the encryption architecture, identify sensitive keys, or enumerate available cryptographic resources for targeted attacks.

Keychain Export - MacOS [snowflake-crowdstrikefdr_process]

Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. Keychains can be viewed and edited through the Keychain Access application or using the command-line utility security. This use case detects commands used to access, dump, or export information from keychains. Atomics T1555.001 Test #1

Windows Credentials in Registry Reg Query

The following analytic identifies processes querying the registry for potential passwords or credentials. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that access specific registry paths known to store sensitive information. This activity is significant as it may indicate credential theft attempts, often used by adversaries or post-exploitation tools like winPEAS. If confirmed malicious, this behavior could lead to privilege escalation,

Keychain Export - MacOS [splunk-unix]

Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. Keychains can be viewed and edited through the Keychain Access application or using the command-line utility security. This use case detects commands used to access, dump, or export information from keychains. Atomics T1555.001 Test #1