Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
2
1
Categories
2
2
2
1
1
Platforms
2
1
Products / Services
2
1
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
KQL Query from file: Hunting Rogue Endpoints via SMB Detection
KQL Query from file: Identity Blast Radius
Microsoft Defender for Identity raises alert on suspicious Kerberos ticket, pointing to a potential overpass-the-hash attack.
Once attackers gain credentials for a user with higher privileges, they will use the stolen credentials to sign into other devices and move laterally.
This query finds related sign-in events following overpass-the-hash attack to trace the footprint of the impersonated user.
Once attackers gain credentials for a user with higher privileges, they will use the stolen credentials to sign into other devices and move laterally.
This query finds related sign-in events following overpass-the-hash attack to trace the footprint of the impersonated user.
