Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,308 detections
Filters
Last updated
All Time
Detection languages
2,033
733
398
298
243
Contributors
1,048
740
503
372
239
Categories
20,437
11,828
5,871
5,150
4,864
4,308
Platforms
2,570
792
615
382
319
Products / Services
767
739
659
512
348
MITRE Techniques
2,347
917
847
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
The analytic detects the use of the PowerShell cmdlet `Export-PfxCertificate` on the command line, indicating an attempt to export a certificate from the local Windows Certificate Store. This activity is significant as it may indicate an attempt to exfiltrate authentication certificates, which can be used to impersonate users or decrypt sensitive data. If confirmed malicious, this could lead to unauthorized access and potential data breaches.
This analytic detects executables running from public or temporary locations that are communicating over Windows domain authentication ports/protocols such as LDAP (389), LDAPS (636), and Kerberos (88). It leverages network traffic data to identify processes originating from user-controlled directories. This activity is significant because legitimate applications rarely run from these locations and attempt domain authentication, making it a potential indicator of compromise. If confirmed malicious, attackers could leverage this to access domain resources, potentially leading to further exploitation and lateral movement within the network.
The analytic detects a process attempting to access winlogon.exe to duplicate its handle. This is identified using Sysmon EventCode 10, focusing on processes targeting winlogon.exe with specific access rights (0x1040). This activity is significant because it is a common technique used by adversaries to escalate privileges by leveraging the high privileges and security tokens associated with winlogon.exe. If confirmed malicious, this could allow an attacker to gain elevated privileges, potentially leading to full system compromise and unauthorized access to sensitive information.
The following analytic identifies a source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. It leverages Event ID 4768, which is generated when the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT) and detects failure code 0x6, indicating the user is not found in the Kerberos database. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges. If confirmed malicious, this activity could lead to unauthorized access and potential privilege escalation within the Active Directory environment.
The analytic identifies a source endpoint failing to authenticate with multiple invalid users using the NTLM protocol. It leverages EventCode 4776 and calculates the standard deviation for each host, using the 3-sigma rule to detect anomalies. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges. If confirmed malicious, this activity could lead to unauthorized access or privilege escalation, posing a significant threat to the Active Directory environment. This detection is focused on domain controllers.
This analytic detects suspicious attempts to find private keys and certificates on Linux systems, which may indicate an attacker's effort to access sensitive cryptographic information. Private keys are crucial for securing encrypted communications and data, and unauthorized access to them can lead to severe security breaches, including data decryption and identity theft. By monitoring for unusual or unauthorized searches for files with common private key and certificate extensions using commands like 'find' or 'grep', this analytic helps identify potential threats to cryptographic security, enabling security teams to take swift action to protect the integrity and confidentiality of encrypted information.
The analytic identifies an unusual number of Kerberos service ticket requests (Event ID 4769) originating from a single client address and account. It uses statistical analysis, specifically standard deviation and the 3-sigma rule, to detect anomalies. This activity is significant as it may indicate malicious behavior such as lateral movement, malware staging, or reconnaissance, potentially leading to unauthorized access to multiple endpoints and further compromise.
This analytic identifies a source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. It leverages Windows EventCode 4768, which is generated when the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT) and detects failure code `0x12` (credentials revoked). This behavior is significant as it may indicate a Password Spraying attack targeting disabled accounts, potentially leading to initial access or privilege escalation. If confirmed malicious, attackers could gain unauthorized access or elevate privileges within the Active Directory environment.
The following analytic detects an application attempting to connect and create an ADSI object to perform an LDAP query. It leverages Sysmon EventCode 11 to identify changes in the Active Directory Schema cache files located in %LOCALAPPDATA%\Microsoft\Windows\SchCache or %systemroot%\SchCache. This activity is significant as it can indicate the presence of suspicious applications, such as ransomware, using ADSI object APIs for LDAP queries. If confirmed malicious, this behavior could allow attackers to gather sensitive directory information, potentially leading to further exploitation or lateral movement within the network.
The analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host. It leverages Windows Event Code 4648 and calculates the standard deviation for each host, using the 3-sigma rule to detect anomalies. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges. If confirmed malicious, this activity could lead to unauthorized access, privilege escalation, or further compromise of the Active Directory environment.
The following analytic identifies a source process failing to authenticate multiple users, potentially indicating a Password Spraying attack. It leverages Windows Event 4625, which logs failed logon attempts, and uses statistical analysis to detect anomalies. This activity is significant as it may represent an adversary attempting to gain initial access or elevate privileges within an Active Directory environment. If confirmed malicious, the attacker could compromise multiple accounts, leading to unauthorized access, data exfiltration, or further lateral movement within the network.
The analytic identifies a source endpoint failing to authenticate multiple valid users using the NTLM protocol, potentially indicating a Password Spraying attack. It leverages Event 4776 from Domain Controllers, calculating the standard deviation for each host and applying the 3-sigma rule to detect anomalies. This activity is significant as it may represent an adversary attempting to gain initial access or elevate privileges. If confirmed malicious, the attacker could compromise multiple accounts, leading to unauthorized access and potential lateral movement within the network.
Detects uses of the SysInternals ProcDump utility in which ProcDump or its output (specifically LSASS memory dumps) get renamed, or a dump file is moved or copied to a different name. This behavior is often used by adversaries to evade detection when performing credential dumping.
Detects the execution of 'createdump.exe' or a renamed version of it, specifically when used to dump process memory. The rule looks for the original internal filename 'FX_VER_INTERNALNAME_STR' and command-line arguments indicative of memory dumping, such as '-u' or '--full' combined with '-f' or '--name' and a '.dmp' extension. This technique is often used by adversaries to extract credentials from processes like LSASS.
Detects HandleKatz, a tool designed to duplicate the LSASS process handle with specific access rights (PROCESS_DUP_HANDLE, PROCESS_QUERY_LIMITED_INFORMATION, PROCESS_QUERY_INFORMATION) to later dump its memory without opening new handles. The detection logic focuses on the target image being 'lsass.exe', the specific granted access rights, and a suspicious call trace originating from ntdll.dll with an 'UNKNOWN' module.
Detects the use of 'createdump.exe', a legitimate Windows utility, to dump process memory. This technique is often used by adversaries to extract credentials from processes like LSASS. The rule specifically looks for the execution of 'createdump.exe' or its original filename 'FX_VER_INTERNALNAME_STR' combined with command-line arguments indicative of a memory dump operation, such as '-u', '--full', '-f', '--name', or '.dmp'.
Detects the execution of the XORDump utility, a tool used for dumping process memory, specifically targeting LSASS or using common DLLs for memory dumping like comsvcs, dbghelp, or dbgcore. This activity is indicative of credential access attempts.
Procdump Execution
Sigma
Detects the execution of the SysInternals Procdump utility. Procdump can be used by adversaries to dump process memory, including sensitive processes like LSASS, for credential access.
Detects suspicious execution of 'DumpMinitool.exe', a binary that can be used for credential dumping. The rule looks for executions outside of typical Visual Studio directories, or executions with command-line arguments indicative of memory dumping (e.g., '.txt', 'Full', 'Mini', 'WithHeap') unless the '--dumpType' flag is also present, which might indicate legitimate usage.
This rule detects potential attempts to steal browser data by monitoring process creation events for specific command-line utilities (copy, move, xcopy, robocopy, esentutl) combined with paths commonly associated with web browser user data directories. Adversaries often acquire credentials from web browsers by copying or moving these files, which may contain saved usernames and passwords.
Detects the execution of PowerShell scripts that use the 'Start-NetEventSession' cmdlet to initiate network event and packet capture. This activity can be leveraged by adversaries to sniff network traffic, potentially capturing sensitive information like user credentials, especially when transmitted over unencrypted protocols. This technique is often used for information gathering during an operation.
Page 192 of 206