Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
983 detections
Filters
Last updated
All Time
Detection languages
638
105
82
64
34
Contributors
242
226
216
58
46
Categories
20,443
11,831
5,872
5,155
4,866
983
Platforms
483
405
224
192
62
Products / Services
416
383
182
108
81
MITRE Techniques
496
496
263
234
233
CVEs
4
4
4
3
3
IDS Classtypes
1
This rule detects the use of the hacktool Ruler by Sensepost, specifically looking for 'RULER' in the Workstation or WorkstationName fields of Windows Security Event IDs 4776 (Credential Validation) and 4624/4625 (Logon/Logoff). Ruler is a tool designed to abuse Microsoft Exchange services.
Detects suspicious processes attempting to log on with explicit credentials (Event ID 4648). This rule specifically targets common command-line utilities like cmd.exe, powershell.exe, wmic.exe, net.exe, and reg.exe when they are used to explicitly log on, while filtering out localhost connections and service accounts (users ending with '$') to reduce false positives. This behavior can indicate an adversary attempting to escalate privileges or move laterally using compromised credentials.
Identifies when the same privilege role has multiple activations by the same user, which could indicate an attempt to bypass time-based access restrictions or an adversary repeatedly activating a role for malicious purposes. This alert is triggered by the 'sequentialActivationRenewalsAlertIncident' risk event type in Azure PIM.
Detects when a user successfully logs on to sanctioned applications from an IP address identified as risky by Microsoft Cloud App Security. This indicates a potential compromise of the user's account or an attempt to access resources from an unusual and potentially malicious location.
Detects logons using NTLM authentication, which can indicate the presence of legacy systems or be leveraged by attackers for lateral movement or credential access. Event ID 8002 specifically indicates an NTLM authentication event.
Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.
This rule detects suspicious failed logon attempts by monitoring specific uncommon error codes. These error codes indicate issues such as logons to disabled accounts, attempts outside authorized hours, from unauthorized workstations, or due to trust relationship failures or insufficient logon rights. Such failures can suggest an adversary attempting to bypass security controls or test account validity and permissions.
This rule detects successful or failed logon attempts originating from IP addresses identified by threat intelligence as associated with botnets, command and control (C2) infrastructure, or proxies. The rule specifically looks for 'LogOn' or 'FailedLogOn' activity types where the source IP's threat intelligence indicator type is 'Botnet', 'C2', or 'Proxy', and where activity insights are available.
Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like
Detects logon events (successful or failed) originating from workstations with suspicious or generic names, which can be an indicator of threat actor activity. This pattern has been associated with Akira ransomware campaigns.
This detection rule identifies suspicious logins by service accounts on devices they haven't accessed in the last 14 days. This behavior could indicate a compromised service account being used for lateral movement within the environment. Service accounts typically have a static set of devices they authenticate to, making deviations easier to spot compared to user accounts. However, some service accounts (e.g., MDI service accounts) are known to dynamically log into devices, which may require environment-specific fine-tuning to reduce false positives.
This rule identifies logon attempts on any device within 30 minutes of a user receiving an email categorized as malware, phishing, or spam. It correlates email event data with identity logon events to detect potential compromise scenarios where a user might interact with a malicious email and subsequently log on, possibly indicating a successful initial access or credential compromise.
This rule identifies all logon events within the organization's domain by querying the IdentityLogonEvents table. It extracts distinct account display names, UPNs, device names, destination device names, action types, account domains, and applications involved in the logon.
Detects if multiple users logged into a single machine within the same day.
Detects a successful NTLM network logon from a NULL SID (S-1-0-0). This pattern is a strong indicator of an NTLM relay attack, where an attacker intercepts an authentication attempt and relays it to a target service, such as LDAP on a Domain Controller, to perform actions on behalf of the relayed user. This is often used to modify Group Policy Objects (GPOs).
NTLM Relay Attempt
YARA-L
Detects NTLM successful network logons where the source and destination workstations are the same, excluding loopback addresses. This behavior can be indicative of NTLM relay attacks where an attacker relays authentication from a victim to the victim's own machine, or other forms of NTLM abuse.
The analytic detects successful Remote Desktop Protocol (RDP) login sessions, identified by Windows Security Event ID 4624 with Logon Type 10. This indicates a user has successfully authenticated and established an interactive RDP session, which is a critical indicator of remote access to a Windows system. Correlating this with Event ID 1149 (RDP authentication success) helps differentiate between credential acceptance and actual session establishment.
Threat hunting query looking for successful logon events with user agent strings that are uncommon within your environment.
KQL Query from file: GraphRunner Recon Detection & Response
KQL Query from file: Sentinel KQL Detection for ShadowHound
KQL Query from file: Sentinel All-In-One IP ThreatHunt
Page 41 of 47