Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
983 detections
Filters
Last updated
All Time
Detection languages
638
105
82
64
34
Contributors
242
226
216
58
46
Categories
20,443
11,831
5,872
5,155
4,866
983
Platforms
483
405
224
192
62
Products / Services
416
383
182
108
81
MITRE Techniques
496
496
263
234
233
CVEs
4
4
4
3
3
IDS Classtypes
1
Detects user logins for the same user from different cities within 24 hours.
Detects the potential use of Rubeus by identifying the registration of a new trusted logon process. This activity is often associated with Kerberos-related attacks, where Rubeus is used to manipulate Kerberos tickets or processes for privilege escalation or lateral movement.
Detects potential use of Rubeus via registered new trusted logon process
Detects potential exploitation attempts of the Netlogon Elevation of Privilege Vulnerability (CVE-2020-1472), also known as Zerologon. This rule specifically looks for Event ID 4742 (A computer account was changed) where the SubjectUserName is 'ANONYMOUS LOGON' and the TargetUserName matches a Domain Controller's machine account name (ending with '$'), while filtering out legitimate password changes by checking if 'PasswordLastSet' is not '-'.
Detects potential adversaries leveraging WMI ActiveScriptEventConsumers remotely to move laterally in a network. This event is best correlated and used as an enrichment to determine the potential lateral movement activity.
Detects potential token impersonation and theft on Windows systems. This rule specifically looks for successful logon events (EventID 4624) with a LogonType of 9 (NewCredentials), where the LogonProcessName is 'Advapi' and the AuthenticationPackageName is 'Negotiate', combined with an ImpersonationLevel indicating impersonation. This combination of events is indicative of an attempt to duplicate and impersonate an existing access token, often used for privilege escalation or defense evasion.
Detects logon events (Event ID 4672 and 4964) involving accounts with special privileges or belonging to special groups, such as administrators. The rule filters out the local system account (S-1-5-18) and allows for a configurable filter for valid internal accounts to reduce false positives.
This rule detects successful logon events (EventID 4624) where the LogonType is 9, which signifies a new credentials logon. This logon type is typically associated with the 'RunAs' command or similar functionality, where a user explicitly provides alternate credentials to execute a program or access a resource. Adversaries may use this technique to execute code with different user privileges or to move laterally within an environment using stolen or compromised credentials.
This rule detects suspicious activity related to the Windows User Profile Service, specifically looking for EventID 1511 (Windows cannot find the local profile and is logging you on with a temporary profile) from the 'Microsoft-Windows-User Profiles Service' provider. This event, especially when combined with EventID 1515 (user profile loaded successfully) and the creation of a '\Users\TEMP' directory, can indicate an attempt to exploit vulnerabilities like CVE-2021-34484 or CVE-2022-21919 for privilege escalation. The rule focuses on the initial indication of a temporary profile being loaded.
Detects the use of a specific default username, 'thisisnotvaliduser', during an interactive logon (LogonType 9) event (EventID 4624) on a Windows system. This specific username is associated with the DiagTrackEoP Proof-of-Concept (POC) for privilege escalation.
Detects workstation session lock events that occur automatically after a standard period of inactivity. This event indicates that a user's session has been locked, typically due to inactivity or a manual lock action. While often a security measure, monitoring these events can help identify unusual patterns of workstation locking, which might precede or follow other suspicious activities, or indicate policy compliance issues.
Detect standard users login that are part of high privileged groups such as the Administrator group
RDP login with localhost source address may be a tunnelled login
Alerts on Metasploit host's authentications on the domain.
Detects the default "UserName" used by the DiagTrackEoP POC
Detects successful logon attempts performed with WMI
Locked Workstation
Sigma
Detects locked workstation session events that occur automatically after a standard period of inactivity.
Page 47 of 47