Rule Library

Sigma Rules

382 rules found for "credential-access"

3,707Total
3,116Detection
451Emerging
137Hunting
Detectionlowtest

Azure AD Only Single Factor Authentication Required

Detect when users are authenticating without MFA being required.

Azuresigninlogs
TA0004 · Privilege EscalationTA0003 · PersistenceTA0005 · Defense EvasionTA0001 · Initial Access+3
Mike DuddingtonWed Jul 27cloud
Detectionhightest

Potential MFA Bypass Using Legacy Client Authentication

Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.

Azuresigninlogs
TA0004 · Privilege EscalationTA0003 · PersistenceTA0005 · Defense EvasionTA0001 · Initial Access+3
Harjot SinghMon Mar 20cloud
Detectionhightest

Sign-in Failure Due to Conditional Access Requirements Not Met

Define a baseline threshold for failed sign-ins due to Conditional Access failures

Azuresigninlogs
TA0004 · Privilege EscalationTA0003 · PersistenceTA0005 · Defense EvasionTA0001 · Initial Access+3
Yochana HendersonWed Jun 01cloud
Detectionhightest

Use of Legacy Authentication Protocols

Alert on when legacy authentication has been used on an account

Azuresigninlogs
TA0004 · Privilege EscalationTA0003 · PersistenceTA0005 · Defense EvasionTA0001 · Initial Access+3
Yochana HendersonFri Jun 17cloud
Detectionmediumtest

Multifactor Authentication Denied

User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.

Azuresigninlogs
TA0004 · Privilege EscalationTA0003 · PersistenceTA0005 · Defense EvasionTA0001 · Initial Access+4
AlertIQThu Mar 24cloud
Detectionmediumtest

Multifactor Authentication Interrupted

Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.

Azuresigninlogs
TA0004 · Privilege EscalationTA0003 · PersistenceTA0005 · Defense EvasionTA0001 · Initial Access+4
AlertIQSun Oct 10cloud
Detectionmediumtest

User Access Blocked by Azure Conditional Access

Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.

Azuresigninlogs
TA0004 · Privilege EscalationTA0003 · PersistenceTA0005 · Defense EvasionTA0006 · Credential Access+3
AlertIQSun Oct 10cloud
Detectionmediumtest

Google Cloud Kubernetes Admission Controller

Identifies when an admission controller is executed in GCP Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Google Cloudgcp.audit
TA0004 · Privilege EscalationTA0001 · Initial AccessTA0005 · Defense EvasionTA0003 · Persistence+4
Austin SongerThu Nov 25cloud
Detectionmediumtest

Google Cloud Kubernetes RoleBinding

Detects the creation or patching of potential malicious RoleBinding. This includes RoleBindings and ClusterRoleBinding.

Google Cloudgcp.audit
TA0006 · Credential Access
Austin SongerMon Aug 09cloud
Detectionmediumtest

Google Cloud Kubernetes Secrets Modified or Deleted

Identifies when the Secrets are Modified or Deleted.

Google Cloudgcp.audit
TA0006 · Credential Access
Austin SongerMon Aug 09cloud
Detectionhightest

Disabling Multi Factor Authentication

Detects disabling of Multi Factor Authentication.

Microsoft 365audit
TA0003 · PersistenceTA0005 · Defense EvasionTA0006 · Credential AccessT1556.006 · Multi-Factor Authentication
Splunk Threat Research Team (original rule)+1Mon Sep 18cloud
Detectionmediumtest

Cisco Duo Successful MFA Authentication Via Bypass Code

Detects when a successful MFA authentication occurs due to the use of a bypass code. A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can't use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems.

Ciscoduo
TA0006 · Credential AccessTA0005 · Defense EvasionTA0001 · Initial Access
Nikita KhalimonenkovWed Apr 17identity
Detectionmediumtest

Okta Admin Functions Access Through Proxy

Detects access to Okta admin functions through proxy.

Oktaokta
TA0006 · Credential Access
Muhammad FaisalWed Oct 25identity
Detectionmediumtest

Okta MFA Reset or Deactivated

Detects when an attempt at deactivating or resetting MFA.

Oktaokta
TA0003 · PersistenceTA0006 · Credential AccessTA0005 · Defense EvasionT1556.006 · Multi-Factor Authentication
Austin SongerTue Sep 21identity
Detectionhightest

Potential Okta Password in AlternateID Field

Detects when a user has potentially entered their password into the username field, which will cause the password to be retained in log files.

Oktaokta
TA0006 · Credential AccessT1552 · Unsecured Credentials
kelnageMon Apr 03identity
Detectioninformationaltest

New Okta User Created

Detects new user account creation

Oktaokta
TA0006 · Credential Access
Nasreddine Bencherchali (Nextron Systems)Wed Oct 25identity
Detectionhightest

Credentials In Files - Linux

Detecting attempts to extract passwords with grep

Linuxauditd
TA0006 · Credential AccessT1552.001 · Credentials In Files
Igor Fits+1Thu Oct 15linux
Detectionlowtest

Network Sniffing - Linux

Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

Linuxauditd
TA0006 · Credential AccessTA0007 · DiscoveryT1040 · Network Sniffing
Timur Zinniatullin+1Mon Oct 21linux
Detectionmediumtest

Suspicious History File Operations - Linux

Detects commandline operations on shell history files

Linuxauditd
TA0006 · Credential AccessT1552.003 · Bash History
Mikhail Larin+1Sat Oct 17linux
Detectionhightest

Linux Keylogging with Pam.d

Detect attempt to enable auditing of TTY input

Linuxauditd
TA0009 · CollectionTA0006 · Credential AccessT1003 · OS Credential DumpingT1056.001 · Keylogging
Pawel MazurMon May 24linux
Detectionhightest

Guacamole Two Users Sharing Session Anomaly

Detects suspicious session with two users present

Linuxguacamole
TA0006 · Credential AccessT1212 · Exploitation for Credential Access
Florian Roth (Nextron Systems)Fri Jul 03linux
Detectionhightest

Copy Passwd Or Shadow From TMP Path

Detects when the file "passwd" or "shadow" is copied from tmp path

LinuxProcess Creation
TA0006 · Credential AccessT1552.001 · Credentials In Files
Joseliyo SanchezTue Jan 31linux
Detectionmediumtest

Mount Execution With Hidepid Parameter

Detects execution of the "mount" command with "hidepid" parameter to make invisible processes to other users from the system

LinuxProcess Creation
TA0006 · Credential AccessTA0005 · Defense EvasionT1564 · Hide Artifacts
Joseliyo SanchezThu Jan 12linux
Detectionmediumexperimental

PUA - TruffleHog Execution - Linux

Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously. While it is a legitimate tool, intended for use in CI pipelines and security assessments, It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.

LinuxProcess Creation
TA0007 · DiscoveryTA0006 · Credential AccessT1083 · File and Directory DiscoveryT1552.001 · Credentials In Files
Swachchhanda Shrawan Poudel (Nextron Systems)Wed Sep 24linux
Detectionhightest

Linux Recon Indicators

Detects events with patterns found in commands used for reconnaissance on linux systems

LinuxProcess Creation
TA0043 · ReconnaissanceT1592.004 · Client ConfigurationsTA0006 · Credential AccessT1552.001 · Credentials In Files
Florian Roth (Nextron Systems)Mon Jun 20linux
Detectionhighexperimental

Script Interpreter Spawning Credential Scanner - Linux

Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.

LinuxProcess Creation
TA0006 · Credential AccessT1552 · Unsecured CredentialsTA0002 · ExecutionTA0009 · Collection+2
Swachchhanda Shrawan Poudel (Nextron Systems)Tue Nov 25linux
Detectionmediumtest

Hidden Flag Set On File/Directory Via Chflags - MacOS

Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS. When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.

macOSProcess Creation
TA0005 · Defense EvasionTA0006 · Credential AccessTA0011 · Command and ControlT1218 · System Binary Proxy Execution+3
Omar KhaledWed Aug 21macos
Detectionmediumtest

Credentials from Password Stores - Keychain

Detects passwords dumps from Keychain

macOSProcess Creation
TA0006 · Credential AccessT1555.001 · Keychain
Tim Ismilyaev+2Mon Oct 19macos
Detectionhightest

Credentials In Files

Detecting attempts to extract passwords with grep and laZagne

macOSProcess Creation
TA0006 · Credential AccessT1552.001 · Credentials In Files
Igor Fits+2Mon Oct 19macos
Detectionlowtest

GUI Input Capture - macOS

Detects attempts to use system dialog prompts to capture user credentials

macOSProcess Creation
TA0009 · CollectionTA0006 · Credential AccessT1056.002 · GUI Input Capture
remotephone+1Tue Oct 13macos
Detectioninformationaltest

Network Sniffing - MacOs

Detects the usage of tooling to sniff network traffic. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

macOSProcess Creation
TA0007 · DiscoveryTA0006 · Credential AccessT1040 · Network Sniffing
Alejandro Ortuno+1Wed Oct 14macos
Detectionmediumtest

Suspicious History File Operations

Detects commandline operations on shell history files

macOSProcess Creation
TA0006 · Credential AccessT1552.003 · Bash History
Mikhail Larin+1Sat Oct 17macos
Detectionlowtest

Cisco Collect Data

Collect pertinent data from the configuration files

Ciscoaaa
TA0007 · DiscoveryTA0006 · Credential AccessTA0009 · CollectionT1087.001 · Local Account+2
Austin ClarkSun Aug 11network
Detectionhightest

Cisco Crypto Commands

Show when private keys are being exported from the device, or when new certificates are installed

Ciscoaaa
TA0006 · Credential AccessTA0005 · Defense EvasionT1553.004 · Install Root CertificateT1552.004 · Private Keys
Austin ClarkMon Aug 12network
Detectionmediumtest

Cisco Show Commands Input

See what commands are being input into the device by other people, full credentials can be in the history

Ciscoaaa
TA0006 · Credential AccessT1552.003 · Bash History
Austin ClarkSun Aug 11network
Detectionmediumtest

Cisco Sniffing

Show when a monitor or a span/rspan is setup or modified

Ciscoaaa
TA0006 · Credential AccessTA0007 · DiscoveryT1040 · Network Sniffing
Austin ClarkSun Aug 11network
Detectionlowtest

Cisco BGP Authentication Failures

Detects BGP failures which may be indicative of brute force attacks to manipulate routing

Ciscobgp
TA0001 · Initial AccessTA0003 · PersistenceTA0004 · Privilege EscalationTA0005 · Defense Evasion+5
Tim BrownMon Jan 09network
Detectionlowtest

Cisco LDP Authentication Failures

Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

Ciscoldp
TA0001 · Initial AccessTA0003 · PersistenceTA0004 · Privilege EscalationTA0005 · Defense Evasion+5
Tim BrownMon Jan 09network
Detectionlowstable

Cleartext Protocol Usage

Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels. Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access.

Firewall
TA0006 · Credential Access
Alexandr Yampolskyi+2Tue Mar 26network
Detectionlowtest

Huawei BGP Authentication Failures

Detects BGP failures which may be indicative of brute force attacks to manipulate routing.

huaweibgp
TA0001 · Initial AccessTA0003 · PersistenceTA0004 · Privilege EscalationTA0005 · Defense Evasion+5
Tim BrownMon Jan 09network
Detectionlowtest

Juniper BGP Missing MD5

Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.

Juniperbgp
TA0001 · Initial AccessTA0003 · PersistenceTA0004 · Privilege EscalationTA0005 · Defense Evasion+5
Tim BrownMon Jan 09network
Detectionmediumtest

Potential PetitPotam Attack Via EFS RPC Calls

Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack refereed to as PetitPotam. The usage of this RPC function should be rare if ever used at all. Thus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation to determine if it is legitimate. View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'

Zeek (Bro)dce_rpc
TA0009 · CollectionTA0006 · Credential AccessT1557.001 · LLMNR/NBT-NS Poisoning and SMB RelayT1187 · Forced Authentication
@neu5ron+2Tue Aug 17network
Detectionhighexperimental

Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network

Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.

Zeek (Bro)dns
TA0009 · CollectionTA0006 · Credential AccessTA0003 · PersistenceTA0004 · Privilege Escalation+2
Swachchhanda Shrawan Poudel (Nextron Systems)Fri Jun 20network
Detectionhightest

Possible Impacket SecretDump Remote Activity - Zeek

Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml

Zeek (Bro)smb_files
TA0006 · Credential AccessT1003.002 · Security Account ManagerT1003.004 · LSA SecretsT1003.003 · NTDS
Samir BousseadenThu Mar 19network
Detectionmediumtest

Transferring Files with Credential Data via Network Shares - Zeek

Transferring files with well-known filenames (sensitive files with credential data) using network shares

Zeek (Bro)smb_files
TA0006 · Credential AccessT1003.002 · Security Account ManagerT1003.001 · LSASS MemoryT1003.003 · NTDS
@neu5ron+2Thu Apr 02network
Detectionmediumtest

Kerberos Network Traffic RC4 Ticket Encryption

Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting

Zeek (Bro)kerberos
TA0006 · Credential AccessT1558.003 · Kerberoasting
sigmaWed Feb 12network
Detectionlowtest

Suspicious Network Communication With IPFS

Detects connections to interplanetary file system (IPFS) containing a user's email address which mirrors behaviours observed in recent phishing campaigns leveraging IPFS to host credential harvesting webpages.

Proxy Log
TA0009 · CollectionTA0006 · Credential AccessT1056 · Input Capture
Gavin KnappThu Mar 16web
Detectionhightest

Hack Tool User Agent

Detects suspicious user agent strings user by hack tools in proxy logs

Proxy Log
TA0001 · Initial AccessT1190 · Exploit Public-Facing ApplicationTA0006 · Credential AccessT1110 · Brute Force
Florian Roth (Nextron Systems)Sat Jul 08web