Browse Rules

Search and filter across all detection sources

2,512 rules

sagan informational other

[WINDOWS-SECURITY] Credential Manager credentials were backed up

[WINDOWS-SECURITY] Credential Manager credentials were backed up
sagan informational other

[WINDOWS-SECURITY] Credential Manager credentials were backed up

[WINDOWS-SECURITY] Credential Manager credentials were backed up
sagan informational other

[WINDOWS-SECURITY] Credential Manager credentials were restored from a backup

[WINDOWS-SECURITY] Credential Manager credentials were restored from a backup
sagan informational other

[WINDOWS-SECURITY] Credential Manager credentials were restored from a backup

[WINDOWS-SECURITY] Credential Manager credentials were restored from a backup
hayabusa high sigma

PowerShell Credential Prompt

Detects PowerShell calling a credential prompt
sentinel high kql

SSH Credentials Changed

Detects when SSH credentials are updated.
sigma high sigma

PowerShell Credential Prompt

Detects PowerShell calling a credential prompt
sagan medium other

[MICROSOFT-ATP] CredentialAccess alert

[MICROSOFT-ATP] CredentialAccess alert
sagan medium other

[NETSKOPE] Compromised Credential alert

[NETSKOPE] Compromised Credential alert
sagan informational other

[ONELOGIN] API_CREDENTIAL_CREATED

[ONELOGIN] API_CREDENTIAL_CREATED
sagan informational other

[ONELOGIN] API_CREDENTIAL_DELETED

[ONELOGIN] API_CREDENTIAL_DELETED
sagan informational other

[ONELOGIN] API_CREDENTIAL_DISABLED

[ONELOGIN] API_CREDENTIAL_DISABLED
sagan informational other

[ONELOGIN] API_CREDENTIAL_ENABLED

[ONELOGIN] API_CREDENTIAL_ENABLED
sagan informational other

[SALESFORCE] CredentialStuffingEvent event detected

[SALESFORCE] CredentialStuffingEvent event detected
sagan informational other

[SOPHOS] Invalid AWS credentials

[SOPHOS] Invalid AWS credentials
sagan informational other

[SOPHOS] Invalid Azure credentials

[SOPHOS] Invalid Azure credentials
sagan informational other

[VEEAM] Credential Record Deleted

[VEEAM] Credential Record Deleted
sagan informational other

[VEEAM] Credential Record Updated

[VEEAM] Credential Record Updated
sagan informational other

[VEEAM] SSH Credentials Changed

[VEEAM] SSH Credentials Changed
hayabusa medium sigma

Windows Credential Manager Access via VaultCmd

List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe
sigma medium sigma

Windows Credential Manager Access via VaultCmd

List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe
sentinel medium kql

Flare leaked credentials results

'This query searches for leaked credential events.'

sigma high sigma

Added Credentials to Existing Application

Detects when a new credential is added to an existing application. Any additional credentials added outside of expected processes could be a malicious actor using those credentials.
hayabusa medium sigma

Windows Credential Manager Access via VaultCmd

List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe
hayabusa low sigma

Outgoing Logon with New Credentials

Detects logon events that specify new credentials