Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,439
11,829
5,873
5,151
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
This rule detects when a user registers security information, which indicates a change to their authentication method. This could be an attacker adding an authentication method to a compromised account to maintain persistent access.
This rule detects the addition of a Security Identifier (SID) to an Active Directory object's SID History attribute. Attackers can manipulate the SID History to gain unauthorized privileges, often by adding SIDs of highly privileged accounts (like Domain Admins) to a compromised user or computer object. This allows the compromised account to impersonate the privileged account and bypass access controls. The rule specifically looks for Event IDs 4765 (SID History added to an account) or 4766 (SID History added to a group) or Event ID 4738 (User Account Changed) where the 'SidHistory' field is not null or '%%1793' (which indicates no SID History).
This rule detects the creation of specific named pipes ('\imposecost' or '\imposingcost') which are known to be used by the 'Koh' tool. The 'Koh' tool is associated with credential access and privilege escalation techniques, often involving token impersonation or theft. Detection relies on Sysmon Event ID 17 or 18, which logs named pipe creation.
Detects activity mentioned in the Operation Wocao report, specifically the use of 'checkadmin.exe' to enumerate local administrators. This tool is used by the threat actor to identify potential targets for privilege escalation or lateral movement.
Identifies when the same privilege role has multiple activations by the same user, which could indicate an attempt to bypass time-based access restrictions or an adversary repeatedly activating a role for malicious purposes. This alert is triggered by the 'sequentialActivationRenewalsAlertIncident' risk event type in Azure PIM.
Detects the execution of Windows Credential Editor (WCE), a post-exploitation tool used to extract plaintext passwords, hashes, PIN codes, and Kerberos tickets from memory. This tool is commonly employed by threat actors for credential dumping and facilitating lateral movement within compromised networks.
This rule detects attempts to capture user credentials on macOS by leveraging the `osascript` utility to display system dialog prompts. It specifically looks for `osascript` executions that include commands to 'display dialog' with keywords commonly associated with credential requests, such as 'admin', 'password', 'authenticate', or 'credentials'. This technique can be used by adversaries to present seemingly legitimate pop-ups to trick users into entering their credentials.
Detects the execution of KrbRelayUp, a hack tool used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced. The rule identifies the tool by its executable name or original filename and specific command-line arguments associated with its relay, krbscm, and spawn functionalities.
Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.
This rule detects modifications to the Windows Registry key `HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential` where its value is set to `0x00000001`. This modification enables the WDigest protocol to store clear-text credentials in memory, making them vulnerable to credential dumping attacks. Adversaries often enable this setting to facilitate the extraction of user credentials from the Local Security Authority Subsystem Service (LSASS) process.
This rule detects attempts by a process to access the memory of 'svchost.exe' with a specific access right ('0x143a'), which is indicative of a credential dumping attempt. The rule filters out legitimate access from 'services.exe' and 'msiexec.exe' to reduce false positives.
Detects the modification of the Local Security Authority (LSA) configuration to register a malicious password filter DLL. This is achieved by looking for command-line arguments that attempt to add or modify registry keys under 'HKLM\SYSTEM\CurrentControlSet\Control\Lsa' related to password filters, specifically involving 'scecli' and 'reg add'. This technique is often used by adversaries to harvest credentials.
This rule detects modifications to the "DsrmAdminLogonBehavior" registry value. Attackers may modify this value to abuse the Directory Services Restore Mode (DSRM) administrator account for persistence and access to Active Directory. The DSRM account is a local administrator account on a Domain Controller, typically used for restoring AD backups or recovering from failures. By changing "DsrmAdminLogonBehavior" from its default value of '0' (only usable in DSRM) to '1' (usable when AD DS service is stopped) or '2' (always usable), attackers can gain persistent access to the Domain Controller outside of DSRM, facilitating credential access and defense evasion.
This rule detects attempts to search for JSON Web Tokens (JWTs) via command-line interface (CLI) tools. It specifically looks for common JWT header prefixes ('eyJ0eXAiOi' and 'eyJhbGciOi') within command-line arguments of tools like 'find', 'findstr', 'select-string', and 'strings'. Threat actors often search for these tokens to steal them for purposes such as lateral movement or privilege escalation, as JWTs are widely used for authentication and authorization in various applications and services (e.g., Microsoft 365, Azure, AWS, Google Cloud).
The analytic detects the execution of Mimikatz commands via PowerShell by leveraging PowerShell Script Block Logging (EventCode=4104). This method captures and logs the full command sent to PowerShell, allowing for the identification of suspicious activities such as Pass the Ticket, Pass the Hash, and credential dumping. This activity is significant as Mimikatz is a well-known tool used for credential theft and lateral movement. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information within the environment.
This rule will collect the data needed to start looking into possible kerberoasting activity.
Further analysis or computation within the query is needed focusing on requests from one specific host/IP towards multiple service names within a time period of 5 seconds.
You can then set a threshold for the number of requests and time between the requests to turn this into an alert.
Further analysis or computation within the query is needed focusing on requests from one specific host/IP towards multiple service names within a time period of 5 seconds.
You can then set a threshold for the number of requests and time between the requests to turn this into an alert.
This detection identifies when a user successfully authenticates from a country for the first time within a given period. It establishes a baseline of known countries for each user and alerts on any successful login originating from a country not present in that baseline. This behavior can indicate compromised credentials being used from an unusual location, or a legitimate user traveling to a new country.
The following analytic detects the use of `powershell.exe` to query the domain for Service Principal Names (SPNs) using Script Block Logging EventCode 4104. It identifies the use of the KerberosRequestorSecurityToken class within the script block, which is equivalent to using setspn.exe. This activity is significant as it often precedes kerberoasting or silver ticket attacks, which can lead to credential theft. If confirmed malicious, attackers could leverage this information to escalate privileges or persist within the environment.
Detects potential credential harvesting attempts through LSASS memory dumps using ProcDump. This rule identifies suspicious command-line patterns that combine memory dump flags (-ma, -mm, -mp) with LSASS-related process markers. LSASS (Local Security Authority Subsystem Service) contains sensitive authentication data including plaintext passwords, NTLM hashes, and Kerberos tickets in memory. Attackers commonly dump LSASS memory to extract credentials for lateral movement and privilege escalation.
The following analytic detects suspicious attempts to find credentials stored in password stores, indicating a potential attacker's effort to access sensitive login information. Password stores are critical repositories that contain valuable credentials, and unauthorized access to them can lead to significant security breaches. By monitoring for unusual or unauthorized activities related to password store access, this analytic helps identify potential credential theft attempts, allowing security teams to respond promptly and prevent unauthorized access to critical systems and data.
The following analytic detects suspicious attempts to find SSH private keys, which may indicate an attacker's effort to compromise secure access to systems. SSH private keys are essential for secure authentication, and unauthorized access to these keys can enable attackers to gain unauthorized access to servers and other critical infrastructure. By monitoring for unusual or unauthorized searches for SSH private keys, this analytic helps identify potential threats to network security, allowing security teams to quickly respond and safeguard against unauthorized access and potential breaches.
Page 165 of 206