Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
142 detections
Filters
Last updated
All Time
Detection languages
51
40
14
10
8
Contributors
37
32
17
10
9
Categories
94
71
28
19
16
Platforms
140
8
2
2
Products / Services
88
82
14
7
5
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
3
1
IDS Classtypes
2
1
1
IDS Protocols
4
2
Detects Active Directory DCSync attempts by monitoring for Windows Security Event ID 4662 where the object properties contain GUIDs associated with directory replication services (DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, and DS-Replication-Get-Changes-In-Filtered-Set). The rule excludes domain controller machine accounts and known legitimate service accounts used for synchronization or backup operations.
Detects unauthorized attempts to exercise Active Directory replication rights (DS-Replication-Get-Changes). This occurs when non-machine accounts access specific control access rights (GUIDs 1131f6aa, 1131f6ad, or 89e95b76) on a domain controller, a common indicator of a DCSync attack used to extract password hashes from Active Directory.
Detects a DCSync (directory replication) request targeting the krbtgt account, which yields the key material needed to forge Golden Tickets and impersonate any domain user. CISA's red team DCSynced krbtgt early in its Active Directory compromise (AA26-237A).
The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory.
These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.
These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.
Detects Active Directory replication events (Event ID 4662) targeting sensitive objects related to replication (e.g., Replication-Get-Changes-All). The rule filters out known Domain Controllers and designated replication service accounts to identify potential DCSync attacks or unauthorized directory replication attempts.
Detects Active Directory replication events (Event ID 4662) targeting sensitive objects related to replication (e.g., Replication-Get-Changes-All). The rule filters out known Domain Controllers and designated replication service accounts to identify potential DCSync attacks or unauthorized directory replication attempts.
Detects instances where a host that is not identified as a Domain Controller performs a DRSUAPI 'DRSGetNCChanges' request against another Domain Controller. This pattern is commonly associated with DCSync attacks, where an adversary mimics the Active Directory replication process to extract password hashes.
Detects instances where a host that is not identified as a Domain Controller performs a DRSUAPI 'DRSGetNCChanges' request against another Domain Controller. This pattern is commonly associated with DCSync attacks, where an adversary mimics the Active Directory replication process to extract password hashes.
Detects suspicious Active Directory Replication Service (ADRS) requests originating from
a machine account (SubjectUserName ending in '$') rather than a legitimate Domain Controller.
Under normal operation, only Domain Controllers initiate replication requests carrying the
DS-Replication-Get-Changes-All right. If a threat actor obtains valid machine account
credentials — for example by abusing certificate-based authentication (PKINIT) to
impersonate a DC after exploiting a CA vulnerability such as CVE-2026-54121 (Certighost),
where a temporary machine account is created to request a DC certificate and then used to
perform DCSync — they can dump all domain credential material including the krbtgt hash.
a machine account (SubjectUserName ending in '$') rather than a legitimate Domain Controller.
Under normal operation, only Domain Controllers initiate replication requests carrying the
DS-Replication-Get-Changes-All right. If a threat actor obtains valid machine account
credentials — for example by abusing certificate-based authentication (PKINIT) to
impersonate a DC after exploiting a CA vulnerability such as CVE-2026-54121 (Certighost),
where a temporary machine account is created to request a DC certificate and then used to
perform DCSync — they can dump all domain credential material including the krbtgt hash.
Detects Defender XDR alerts and evidence potentially related to Certighost / CVE-2026-54121 AD CS abuse, including suspicious certificate requests, Kerberos activity, LDAP security principal anomalies, and possible DCSync or directory replication abuse.
KQL Query from file: Hunting Mirage kitten AKA unc1549
Detects two distinct offensive patterns: Impacket PsExec usage, identified by a Type-3 network logon followed within 2 minutes by an ADMIN$ service installation matching typical PsExec naming patterns; and DCSync replication requests originating from non-Domain Controller accounts.
Detects two distinct offensive patterns: Impacket PsExec usage, identified by a Type-3 network logon followed within 2 minutes by an ADMIN$ service installation matching typical PsExec naming patterns; and DCSync replication requests originating from non-Domain Controller accounts.
This KQL is designed to hunt for activity that may indicate Active Directory Certificate Services abuse or Certighost-like domain compromise behavior, especially where an attacker may manipulate machine account attributes, impersonate domain-controller-like behavior, or perform follow-on credential extraction.
Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.
Certighost
KQL
These credentials are used to perform DCSync or other activities, resulting in logon events from domain controller computer account originating from a non-domain controller IP address.
Detects privileged Active Directory enumeration seen on the wire by Corelight, filtered to source hosts that don't appear in the Cortex endpoint inventory. It reads ldap_search records from corelight_zeek_raw, tiers them by the LDAP filter (CRITICAL for credential-attribute and DCSync hunting, HIGH for Tier Zero, Kerberoast, delegation, and UAC-bitmask targeting, MEDIUM for broad group, computer, and GPO enumeration), then joins the source address against endpoints and keeps only the queries whose id_orig_h has no matching managed agent
Detects privileged Active Directory enumeration seen on the wire by Corelight, filtered to source hosts that don't appear in the Cortex endpoint inventory. It reads ldap_search records from corelight_zeek_raw, tiers them by the LDAP filter (CRITICAL for credential-attribute and DCSync hunting, HIGH for Tier Zero, Kerberoast, delegation, and UAC-bitmask targeting, MEDIUM for broad group, computer, and GPO enumeration), then joins the source address against endpoints and keeps only the queries whose id_orig_h has no matching managed agent
Detects Active Directory replication requests (DsGetNcChanges) performed by accounts not identified as Domain Controllers. This behavior is indicative of a DCSync attack, where an adversary uses the directory replication API to extract credentials from Active Directory, potentially leveraging exploited computer accounts.
Detects the execution of known Mimikatz credential dumping commands, specifically 'lsadump::dcsync' used for Active Directory credential extraction, and 'sekurlsa' used for extracting credentials from the LSASS process memory.
Detects the execution of Mimikatz with command line arguments indicative of credential dumping, specifically DCSync attacks or dumping LSASS memory for passwords. The rule filters out processes signed by Microsoft to reduce noise.
Page 3 of 7