Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
142 detections
Filters
Last updated
All Time
Detection languages
51
40
14
10
8
Contributors
37
32
17
10
9
Categories
94
71
28
19
16
Platforms
140
8
2
2
Products / Services
88
82
14
7
5
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
3
1
IDS Classtypes
2
1
1
IDS Protocols
4
2
Detects the use of Mimikatz to perform a DCSync attack, which allows an adversary to simulate the replication process from a domain controller to extract sensitive password hashes from Active Directory.
Detects unauthorized or non-standard attempts to replicate directory data from a Domain Controller, specifically looking for Directory Replication Service (DRS) GetChanges and GetChangesAll access requests. This behavior is indicative of a DCSync attack, often used by adversaries to dump credentials from the NTDS.dit database.
Detects the execution of Mimikatz or its common command-line arguments used for credential dumping. This rule identifies attempts to extract sensitive authentication material such as passwords, hashes, and tickets from memory (LSASS), SAM database, LSA secrets, and cached domain credentials.
This rule detects multiple attempts by a user account to perform a Directory Synchronization (DirSync) operation, which is a common indicator of a DCSync attack. The rule specifically looks for Event ID 4662 with properties containing 'DS-DirSync' or '131072', filters for user accounts, excludes known service accounts, and triggers if there are 5 or more attempts from the same account and computer.
This rule detects the execution of common Active Directory enumeration and exploitation tools, specifically Impacket (secretsdump, getuserspns, ntlmrelayx) and BloodHound/SharpHound, by monitoring Windows Sysmon process creation events for known file names and command-line arguments.
Detects the execution of Mimikatz or its common command-line arguments used for credential dumping. This rule identifies attempts to extract sensitive authentication material such as passwords, hashes, and tickets from memory (LSASS), SAM database, LSA secrets, and cached domain credentials.
This rule detects activities associated with credential dumping, specifically targeting techniques that abuse the Directory Replication Service (DRS) protocol, such as DCSync or the use of tools like secretsdump. It monitors both process execution command lines and network traffic for keywords indicative of these credential extraction behaviors, which are commonly used by attackers to obtain domain credentials.
Detects the use of Mimikatz to perform a DCSync attack, which allows an adversary to simulate the replication process from a domain controller to extract sensitive password hashes from Active Directory.
Detects DCSync replication attack for credential dumping from AD
This rule detects the execution of processes with command-line arguments indicative of credential theft tools such as Mimikatz, lsadump, sekurlsa, vault, cachedump, or hashdump. It specifically looks for these keywords within Security Event ID 4688 (a process creation event) logs.
This rule detects multiple attempts by a user account to perform a Directory Synchronization (DirSync) operation, which is a common indicator of a DCSync attack. The rule specifically looks for Event ID 4662 with properties containing 'DS-DirSync' or '131072', filters for user accounts, excludes known service accounts, and triggers if there are 5 or more attempts from the same account and computer.
Detects SID history manipulation for domain privilege escalation
This rule detects the execution of processes with command-line arguments indicative of credential theft tools such as Mimikatz, lsadump, sekurlsa, vault, cachedump, or hashdump. It specifically looks for these keywords within Security Event ID 4688 (a process creation event) logs.
Detects unauthorized domain controller replication that may indicate DCSync or rogue DC
The rule detects the use of Mimikatz by searching for specific keywords within Windows event logs. These keywords include Mimikatz module commands (e.g., 'dpapi::masterkey', 'kerberos::golden', 'lsadump::', 'sekurlsa::'), artifacts associated with Mimikatz (e.g., 'mimidrv.sys', 'mimilib.dll'), and PowerShell commands commonly used with Mimikatz (e.g., 'Invoke-Mimikatz', 'Invoke-Mimikittenz'). The detection logic specifically excludes events with EventID 15.
This rule detects multiple attempts by a user account to perform a Directory Synchronization (DirSync) operation, which is a common indicator of a DCSync attack. The rule specifically looks for Event ID 4662 with properties containing 'DS-DirSync' or '131072', filters for user accounts, excludes known service accounts, and triggers if there are 5 or more attempts from the same account and computer.
This rule detects a DCSync attack by looking for the "DsGetNCChanges" string in TCP traffic on port 389 (LDAP). DCSync is a technique used by attackers to simulate a domain controller and request directory replication, allowing them to extract password hashes and other sensitive information from Active Directory.
Detects access to sensitive files, credential data, or remote procedure call (RPC) endpoints related to credential dumping over a network share.
This could indicate lateral movement or remote credential harvesting techniques.
This could indicate lateral movement or remote credential harvesting techniques.
This hunt targets a documented Iranian MOIS-affiliated behaviour: re-executing DCSync
(MITRE ATT&CK T1003.006 — OS Credential Dumping: DCSync) after defenders reset
compromised account passwords, allowing actors to recollect current and historical NTLM
hashes and restore domain-wide access without repeating initial access stages.
(MITRE ATT&CK T1003.006 — OS Credential Dumping: DCSync) after defenders reset
compromised account passwords, allowing actors to recollect current and historical NTLM
hashes and restore domain-wide access without repeating initial access stages.
This hunt targets a documented Iranian MOIS-affiliated behaviour: re-executing DCSync
(MITRE ATT&CK T1003.006 — OS Credential Dumping: DCSync) after defenders reset
compromised account passwords, allowing actors to recollect current and historical NTLM
hashes and restore domain-wide access without repeating initial access stages.
(MITRE ATT&CK T1003.006 — OS Credential Dumping: DCSync) after defenders reset
compromised account passwords, allowing actors to recollect current and historical NTLM
hashes and restore domain-wide access without repeating initial access stages.
This rule detects activity associated with a specific threat actor targeting FortiGate devices. It identifies network connections to known threat actor infrastructure IPs, attempts to access FortiGate management ports (443, 8443, 10443, 4443) over TCP, and successful administrative or VPN authentications from the threat actor's IPs in Fortinet/FortiGate logs. Additionally, it looks for DCSync-style directory replication access (event ID 4662) in Windows Security logs, indicating potential Active Directory compromise.
Page 5 of 7