Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12 detections
Filters
Last updated
All Time
Detection languages
5
3
2
1
1
Contributors
3
2
2
2
1
Categories
6
6
5
5
3
Platforms
11
Products / Services
3
2
2
2
2
MITRE Techniques
4
4
4
3
3
CVEs
71
71
64
58
49
This rule detects suspicious activity related to the Netlogon service or the LSASS process. It triggers on Netlogon service events (5827, 5828, 5829) which may indicate insecure channel usage or service issues often associated with exploitation, and on Sysmon Event ID 1 where a process is spawned by lsass.exe under the SYSTEM user, a behavior frequently seen during credential dumping or privilege escalation attempts.
This rule detects suspicious activity related to the Netlogon service or the LSASS process. It triggers on Netlogon service events (5827, 5828, 5829) which may indicate insecure channel usage or service issues often associated with exploitation, and on Sysmon Event ID 1 where a process is spawned by lsass.exe under the SYSTEM user, a behavior frequently seen during credential dumping or privilege escalation attempts.
This rule detects the creation of suspicious child processes by 'lsass.exe' on Windows systems. LSASS (Local Security Authority Subsystem Service) is a critical Windows process responsible for enforcing security policies. Under normal circumstances, LSASS should not spawn common command-line interpreters or system utilities like cmd.exe, powershell.exe, or rundll32.exe. Such activity is highly indicative of post-exploitation behavior, potentially following a successful compromise like the referenced CVE-2026-41089 Netlogon RCE, where an attacker might use LSASS to execute further commands or tools.
https://www.sentinelone.com/vulnerability-database/cve-2026-41089/
Targets anomalous Netlogon or CLDAP traffic followed by LSASS termination or domain-controller restart indicators. The UDM rule retains principal and target context for correlation.
Detects suspicious child processes spawned by lsass.exe, which may indicate exploitation of the Netlogon service or credential dumping activity.
Targets anomalous Netlogon or CLDAP traffic followed by LSASS termination or domain-controller restart indicators. The UDM rule retains principal and target context for correlation.
CVE-2026-41089 is a stack-based buffer overflow vulnerability located within the Windows Netlogon service (netlogon.dll). Netlogon is a core Authentication Service component that maintains the secure channel (Schannel) between domain-joined computers and Domain Controllers (DCs) for user authentication.
CVSSv3: 9.8
Impacts:
Because the Netlogon service runs as SYSTEM (or effectively within lsass.exe which has SYSTEM privileges), any code executed via this exploit inherits those permissions. This allows the attacker to:
Install malicious services or persistence mechanisms.
Dump the NTDS.dit database (all credential hashes).
Create Golden Tickets (Kerberos Ticket Granting Tickets) for total domain persistence.
CVSSv3: 9.8
Impacts:
Because the Netlogon service runs as SYSTEM (or effectively within lsass.exe which has SYSTEM privileges), any code executed via this exploit inherits those permissions. This allows the attacker to:
Install malicious services or persistence mechanisms.
Dump the NTDS.dit database (all credential hashes).
Create Golden Tickets (Kerberos Ticket Granting Tickets) for total domain persistence.
Detects Windows Error Reporting (Event ID 1000) events associated with lsass.exe crashes. Memory corruption exploits, such as CVE-2026-41089 (Netlogon RCE), often cause service instability. Monitoring for lsass.exe crashes can reveal failed exploitation attempts or other critical system issues.
Detects high volumes of network connections directed at Domain Controller RPC and authentication ports from a single source. This may indicate reachability testing, scanning, or exploitation attempts associated with CVE-2026-41089 (Netlogon RCE).
This rule detects the creation of suspicious child processes by 'lsass.exe' on Windows systems. LSASS (Local Security Authority Subsystem Service) is a critical Windows process responsible for enforcing security policies. Under normal circumstances, LSASS should not spawn common command-line interpreters or system utilities like cmd.exe, powershell.exe, or rundll32.exe. Such activity is highly indicative of post-exploitation behavior, potentially following a successful compromise like the referenced CVE-2026-41089 Netlogon RCE, where an attacker might use LSASS to execute further commands or tools.
Detects instances where the Local Security Authority Subsystem Service (lsass.exe) spawns unexpected command shells or script interpreters. This is a strong indicator of post-exploitation activity following CVE-2026-41089 exploitation.