Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
236 detections
Filters
Last updated
All Time
Detection languages
100
47
32
24
10
Contributors
52
45
40
28
16
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
158
60
20
14
4
Products / Services
65
55
49
49
40
MITRE Techniques
74
66
39
27
22
CVEs
3
2
2
2
2
IDS Classtypes
30
13
3
1
IDS Protocols
43
2
2
Detects Active Directory Certificate Services (AD CS) certificate request or issuance events where the request attributes contain 'cdc=' or 'rmd=' parameters. These parameters are indicative of the CertiGhost (CVE-2026-54121) exploit, where an attacker coerces the Certificate Authority to interact with an attacker-controlled LDAP or LSA listener by abusing chase-abuse flows during the certificate request process.
Detects executables with digital signatures that fail trust validation while claiming to be from well-known vendors, consistent with Dolphin X's 'Fake Code Signature' mechanism. This technique attempts to evade defenses by masquerading as a trusted application.
This rule detects potential Active Directory Certificate Services (ADCS) ESC17 abuse by monitoring for certificate requests that contain a Subject Alternative Name (SAN) or Common Name (CN) matching trusted external domains such as 'login.microsoftonline.com'. It also monitors for Certipy command-line activity targeting insecure web server templates or attempting ESC17-specific maneuvers, which indicates an attempt to forge certificates for domain impersonation or unauthorized authentication.
Detects established TLS traffic over WebSockets where the certificate subject field lacks a common name (CN), often indicative of non-standard, self-signed, or improperly generated TLS certificates used by command-and-control (C2) agents to bypass standard certificate validation or hide within encrypted channels.
Detects instances where FortiClient EMS (versions 7.4.5 or 7.4.6) logs a 'Certificate not found in request header' error. This indicates that a client attempt to communicate with the EMS server failed due to missing certificate-based authentication, which could suggest misconfiguration, network issues, or potentially an unauthorized attempt to access the management interface.
Detects established TLS connections to external networks where the server certificate subject contains a Common Name (CN) but lacks Organization (O) or Organizational Unit (OU) fields. This pattern is characteristic of basic, potentially malicious self-signed certificates used by command-and-control (C2) frameworks to mask communication.
Detects the installation of an attacker-controlled root certificate into the Windows certificate store using certutil.exe. This activity is correlated with the modification of Firefox browser settings to trust the Windows OS certificate store, an action often performed to facilitate TLS interception and traffic stripping.
Detects Active Directory Certificate Services (ADCS) certificate enrollment requests where the requester attempts to enroll a certificate with a Subject Alternative Name (SAN) identifying a different principal than the requester's own account. This pattern is indicative of the ESC1 ADCS misconfiguration abuse, which can lead to privilege escalation by impersonating other domain entities.
Detects Active Directory Certificate Services (ADCS) certificate enrollment requests where the requester attempts to enroll a certificate with a Subject Alternative Name (SAN) identifying a different principal than the requester's own account. This pattern is indicative of the ESC1 ADCS misconfiguration abuse, which can lead to privilege escalation by impersonating other domain entities.
Detects certificate requests containing indicators often associated with Active Directory Certificate Services (AD CS) abuse, such as requests involving Subject Alternative Name (SAN) or smart card authentication attributes, which may indicate attempts to escalate privileges or move laterally via certificate forgery.
Detects the unauthorized addition or peering of rogue devices within a Cisco SD-WAN fabric. This rule monitors vManage and vBond logs for successful peering or registration events that correlate with known rogue indicators, such as certificate validation failures, mismatching system information, or untrusted peer identities. This activity is often indicative of attackers attempting to gain persistent control over the SD-WAN infrastructure, potentially using authentication bypass vulnerabilities or stolen credentials.
Detects suspicious certificate installation or modification in the 'Root' or 'TrustedPeople' stores by PowerShell or certutil.exe. This activity is analyzed in the context of common management tools (e.g., winget) or shell environments, which may indicate an attacker attempting to establish persistence or facilitate man-in-the-middle attacks by injecting malicious root certificates.
This rule detects activities associated with the DSCourier technique, specifically the unauthorized installation of root certificates. It monitors for PowerShell commands importing certificates into the Root store, the use of insecure curl downloads of certificate files, and unauthorized process access to the Windows Root certificate registry hive.
Detects network traffic consistent with the Metasploit Meterpreter reverse HTTPS payload, specifically looking for the default 'CN=metasploit' certificate subject name used by the framework in SSL/TLS handshakes, or connections targeting default Meterpreter ports like 4444.
Detects certificate requests containing indicators often associated with Active Directory Certificate Services (AD CS) abuse, such as requests involving Subject Alternative Name (SAN) or smart card authentication attributes, which may indicate attempts to escalate privileges or move laterally via certificate forgery.
Detects suspicious PowerShell commands used to import certificates into the LocalMachine\Root store. This behavior is often associated with adversaries attempting to establish persistence by installing rogue root certificates to intercept or decrypt encrypted traffic (Man-in-the-Middle) or to bypass security controls. The rule flags instances where certificate installation is invoked by specific suspicious parent processes, utilizes known malicious certificate thumbprints, or explicitly targets the Root store.
This rule detects suspicious activity related to OpenSSL or certificate manipulation by identifying processes that execute commands containing 'openssl' or 'certificate' keywords. It aggregates these activities by computer and account within one-hour bins and flags if three or more such activities occur, which could indicate credential access attempts or system misconfiguration.
Detects Active Directory Certificate Services (ADCS) certificate enrollment requests where the requester attempts to enroll a certificate with a Subject Alternative Name (SAN) identifying a different principal than the requester's own account. This pattern is indicative of the ESC1 ADCS misconfiguration abuse, which can lead to privilege escalation by impersonating other domain entities.
This rule detects the use of the 'SecTrustSetAnchorCertificatesOnly' macOS Security framework API call. This API is used to restrict trust to only the anchor certificates provided, which is a technique often used by malware or malicious scripts to bypass security trust controls, intercept TLS/SSL traffic, or facilitate adversary-in-the-middle attacks.
Detects potential abuse of Active Directory Certificate Services (AD CS) by monitoring for suspicious command-line activity from 'certreq.exe' and 'certutil.exe' associated with certificate enrollment, submission, or management. It also identifies the staging of certificate-related files (.pem, .pfx, .p12, .crt, .cer, .key) in common user directories.
This rule detects the creation or modification of files that contain common certificate-related keywords such as 'crl', 'certificate', or 'pem'. This activity could indicate the deployment of new certificates, which might be legitimate or malicious, such as for establishing command and control, code signing, or evading detection.
Page 7 of 12