Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
236 detections
Filters
Last updated
All Time
Detection languages
100
47
32
24
10
Contributors
52
45
40
28
16
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
158
60
20
14
4
Products / Services
65
55
49
49
40
MITRE Techniques
74
66
39
27
22
CVEs
3
2
2
2
2
IDS Classtypes
30
13
3
1
IDS Protocols
43
2
2
Detects successful Kerberos PKINIT authentication (Event 4768, PreAuthType 16) issued by on-premises certificate authorities. This activity is a potential indicator of Shadow Credentials or Active Directory Certificate Services (AD CS) abuse where attackers use forged or stolen certificates to authenticate as domain users or machines.
Detects the execution of Certipy, an open-source tool used for enumerating and exploiting Active Directory Certificate Services (AD CS). The rule monitors for common command-line arguments used during various stages of AD CS attack lifecycle, including finding misconfigurations, requesting certificates, relaying, and template exploitation.
Detects the execution of Certipy, an open-source tool used for enumerating and exploiting Active Directory Certificate Services (AD CS). The rule monitors for common command-line arguments used during various stages of AD CS attack lifecycle, including finding misconfigurations, requesting certificates, relaying, and template exploitation.
Detects the execution of Certipy, an open-source tool used for enumerating and exploiting Active Directory Certificate Services (AD CS). The rule monitors for common command-line arguments used during various stages of AD CS attack lifecycle, including finding misconfigurations, requesting certificates, relaying, and template exploitation.
Monitors Active Directory Certificate Services (AD CS) for an unusual volume of certificate requests from a single requester within a short timeframe. This behavior is indicative of enumeration or exploitation activity by tools such as Certify or Certipy, which often perform rapid certificate requests to identify vulnerable templates or request certificates for unauthorized identities.
Detects unauthorized modifications to Active Directory Certificate Services (AD CS) template objects (pKICertificateTemplate) using Windows Event ID 5136. This behavior is indicative of ESC4-style attacks, where an adversary with write access to a certificate template modifies security descriptors, enrollment rights, or sensitive configuration flags (like enabling enrollee-supplied SANs or adding a Client Authentication EKU) to facilitate privilege escalation or persistence.
Detects several potentially malicious activities related to Active Directory Certificate Services (AD CS). This includes high volumes of failed requests (potential enumeration), requests for sensitive templates (privilege escalation), and potential impersonation attempts using Subject Alternative Names (SANs). These activities are associated with AD CS abuse techniques.
AD CS ESC8 Certificate Request via NTLM
Cortex XDR
Detects Active Directory Certificate Services (AD CS) certificate requests that utilize NTLM authentication rather than Kerberos. This behavior is indicative of potential NTLM relay attacks (ESC8), where an attacker forces a machine account to authenticate to the AD CS web enrollment endpoint via NTLM to obtain a certificate on behalf of that machine.
Detects Active Directory Certificate Services (AD CS) certificate requests where the Subject Alternative Name (SAN) contains a User Principal Name (UPN) that does not match the requester's identity. This pattern indicates potential exploitation of ESC1 or ESC6 certificate template misconfigurations, allowing an attacker to request certificates for arbitrary identities.
Detects anomalous TLS traffic directed at Binance or Bybit domains where the server certificate issuer is not from a known trusted certificate authority. This behavior is indicative of a Man-in-the-Middle (MITM) proxy interception, often associated with tools like JSCeal attempting to inspect or modify encrypted traffic to financial services.
Detects anomalous TLS traffic directed at Binance or Bybit domains where the server certificate issuer is not from a known trusted certificate authority. This behavior is indicative of a Man-in-the-Middle (MITM) proxy interception, often associated with tools like JSCeal attempting to inspect or modify encrypted traffic to financial services.
Detects the issuance of certificates using templates associated with the Certificate Request Agent. This is a critical component of the ESC3 attack vector, where an adversary first acquires an Enrollment Agent certificate and subsequently uses it to enroll for certificates on behalf of other privileged users or principals.
Detects several potentially malicious activities related to Active Directory Certificate Services (AD CS). This includes high volumes of failed requests (potential enumeration), requests for sensitive templates (privilege escalation), and potential impersonation attempts using Subject Alternative Names (SANs). These activities are associated with AD CS abuse techniques.
This rule detects QUIC network traffic where the TLS certificate subject and issuer match specific patterns associated with 'RAT System' and 'RAT CA'. This signature indicates potential command-and-control (C2) communication utilizing self-signed certificates for authentication pinning in an attempt to masquerade or secure malicious traffic.
This rule monitors for successful certificate enrollments (Event ID 4886 and 4887) using sensitive certificate templates typically reserved for domain controllers or Kerberos authentication. It specifically alerts when these requests are made by user accounts that do not end in '$' (machine accounts) and are not known service accounts like 'CAService', which may indicate unauthorized attempts to obtain high-privilege credentials via AD Certificate Services (AD CS).
This rule monitors for successful certificate enrollments (Event ID 4886 and 4887) using sensitive certificate templates typically reserved for domain controllers or Kerberos authentication. It specifically alerts when these requests are made by user accounts that do not end in '$' (machine accounts) and are not known service accounts like 'CAService', which may indicate unauthorized attempts to obtain high-privilege credentials via AD Certificate Services (AD CS).
Detects instances where a user account requests or enrolls a certificate from Active Directory Certificate Services (AD CS) that is associated with a computer account (SID). This behavior, specifically when the requester is not the computer account itself, is a known indicator of potential AD CS abuse, such as certificate theft or impersonation techniques.
This rule detects outbound TLS connections from the local network to an external destination where the server provides a self-signed certificate. Self-signed certificates are often used by malware for command-and-control (C2) communication or by data exfiltration tools to establish encrypted channels while avoiding the need for legitimate, verifiable PKI infrastructure.
This rule detects potentially malicious child processes spawned by LOLBins (Living Off the Land Binaries) like mshta.exe, wscript.exe, cscript.exe, rundll32.exe, or regsvr32.exe, which were themselves initiated by document applications (e.g., Office, Acrobat) or common shell interpreters. It specifically identifies downstream payloads that are either unsigned or signed by non-trusted publishers, filtering out Microsoft and common third-party software signers.
Detects malicious certificate enrollment requests targeting Active Directory Certificate Services (AD CS) that utilize legacy 'cdc' (Client DC) or 'rmd' (Remote Domain) request attributes, a technique associated with the 'Certighost' exploit (CVE-2026-54121). Additionally, the rule monitors the CA process (certsrv.exe) for suspicious outbound SMB or LDAP connections, which may indicate the abuse of AD CS chase fallback logic to coerce authentication.
Detects anomalous certificate issuance via Active Directory Certificate Services (AD CS) where a machine-template certificate is issued to a non-computer requester, but the issued certificate's Subject Alternative Name contains a dNSHostName identifier associated with a Domain Controller. This pattern matches the exploitation of the 'CertiGhost' vulnerability (CVE-2026-54121), which allows unauthorized entities to obtain certificates masquerading as Domain Controllers for potential Kerberos authentication abuse.
Page 6 of 12