Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18 detections
Filters
Last updated
All Time
Detection languages
11
4
2
1
Contributors
6
4
3
2
1
Categories
11
9
9
8
3
Platforms
17
2
1
1
Products / Services
5
5
4
4
3
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects the execution of known network exploitation tools like Responder.py or MultiRelay.py, as well as unauthorized processes binding to ports used for LLMNR (UDP 5355) and NBT-NS (UDP 137), which are classic indicators of potential adversary-in-the-middle attacks.
Detects use of Responder tool for LLMNR/NBT-NS poisoning attacks
Detects the execution of known LLMNR, NBT-NS, and SMB relaying tools such as Responder, Inveigh, and MultiRelay, or the use of their specific command-line arguments, which are commonly used by adversaries for adversary-in-the-middle attacks to capture or relay authentication material.
Detects the execution of known LLMNR, NBT-NS, and SMB relaying tools such as Responder, Inveigh, and MultiRelay, or the use of their specific command-line arguments, which are commonly used by adversaries for adversary-in-the-middle attacks to capture or relay authentication material.
This rule detects activities associated with AiTM (Adversary-in-the-Middle) attacks, specifically targeting network-based credential interception. It monitors for the execution of well-known poisoning tools (e.g., Responder), ARP spoofing utilities (e.g., ettercap, arpspoof), the creation of suspicious network listeners on protocols used for NBT-NS/LLMNR poisoning, and the execution of credential relaying tools like Impacket.
Detects the execution of known NTLM relay and credential harvesting tools such as Responder, Inveigh, and PetitPotam, or suspicious command-line patterns involving the use of 'net use' or common Windows binaries (e.g., powershell.exe, rundll32.exe) to access or force SMB authentication with remote IP addresses.
Detects the execution of known network exploitation tools like Responder.py or MultiRelay.py, as well as unauthorized processes binding to ports used for LLMNR (UDP 5355) and NBT-NS (UDP 137), which are classic indicators of potential adversary-in-the-middle attacks.
Detects the execution of known NTLM relay and credential harvesting tools such as Responder, Inveigh, and PetitPotam, or suspicious command-line patterns involving the use of 'net use' or common Windows binaries (e.g., powershell.exe, rundll32.exe) to access or force SMB authentication with remote IP addresses.
This rule detects the execution of various hack tools and scripts commonly used for SMB relay attacks and privilege escalation on Windows systems. It specifically looks for process creations or command-line arguments associated with tools like PetitPotam, RottenPotato, HotPotato, JuicyPotato, Responder, ntlmrelayx, and smbrelayx, as well as PowerShell scripts like Invoke-Tater and Invoke-PetitPotam. The rule aims to identify attempts to exploit NTLM relay vulnerabilities to gain elevated privileges or access credentials.
Detects potential LLMNR/NBT-NS poisoning by identifying a single host responding to a high number of distinct client IPs on UDP ports 137 (NBT-NS) or 5355 (LLMNR). This behavior is indicative of an attacker attempting to spoof name resolution to redirect traffic.
Detects potential Active Directory enumeration via LDAP. This rule identifies suspicious LDAP search filters and distinguished name enumerations that are commonly used by reconnaissance tools like PowerView and SharpHound to gather information about users, groups, computers, and domain trusts within an Active Directory environment. The rule specifically looks for various 'groupType', 'sAMAccountType', 'objectCategory', 'objectClass', 'primaryGroupID', 'userAccountControl' attributes, and specific distinguished names or flags that indicate detailed AD reconnaissance.
KQL Query from file: NTLMv2 Hash Leak via COM Detection
KQL Query from file: Sentinel Timeroasting KQL detection
KQL Query
// Detect multiple sensitive Active Directory LDAP queries made in bin time
// Sensitive queries defined as Roasting or sensitive objects queries
// Replace 10 on line 6 with your desired thershold
// Replace 1m on line 7 with your desired bin time
// This LDAP query cover Rubeus, Kerberoast, BloodHound tools
// Sensitive queries defined as Roasting or sensitive objects queries
// Replace 10 on line 6 with your desired thershold
// Replace 1m on line 7 with your desired bin time
// This LDAP query cover Rubeus, Kerberoast, BloodHound tools
Detect Active Directory LDAP queries that search for users with comment or description that contains the string "pass" that might suggest for the user password
This LDAP query cover MetaSploit - enum_ad_user_comments tool
This LDAP query cover MetaSploit - enum_ad_user_comments tool
Detect multiple Active Directory LDAP queries made in bin time
Replace 10 on line 1 with your desired thershold
Replace 1m on line 2 with your desired bin time
Replace 10 on line 1 with your desired thershold
Replace 1m on line 2 with your desired bin time
Detect Active Directory LDAP queries that try to find operating systems that are vulnerable to specific vulnerabilities
This LDAP query cover MetaSploit - enum_ad_computers tool
This LDAP query cover MetaSploit - enum_ad_computers tool