Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
142 detections
Filters
Last updated
All Time
Detection languages
51
40
14
10
8
Contributors
37
32
17
10
9
Categories
94
71
28
19
16
Platforms
140
8
2
2
Products / Services
88
82
14
7
5
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
3
1
IDS Classtypes
2
1
1
IDS Protocols
4
2
This rule detects suspicious network connections to known threat actor infrastructure associated with FortiGate exploitation, successful administrative or VPN logins to FortiGate devices from these IPs, and DCSync-style directory replication access (EventCode 4662) on Windows systems. The rule is composed of three distinct parts targeting different aspects of the attack chain.
This rule detects potential DCSync replication abuse by monitoring Security Event ID 4662, specifically looking for access to 'domainDNS' or user objects with the GUID '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2', which is associated with Directory Replication Service (DRS) permissions. It filters out machine accounts to reduce false positives.
This rule detects the execution of Mimikatz or Mimikatz-related tools and scripts (e.g., DumpCreds, Invoke-Mimikatz, Invoke-Mimikittenz) by analyzing command-line arguments. It specifically looks for the use of various Mimikatz modules and commands, including those related to credential dumping (e.g., sekurlsa::logonpasswords, lsadump::sam, dpapi::masterkey), privilege escalation (e.g., privilege::debug, token::elevate), and other functionalities like Kerberos ticket manipulation (e.g., kerberos::golden, kerberos::ptt).
This rule detects attempts to backdoor a domain object by granting DCSync rights to a regular user or machine account. This is achieved by modifying the 'ntSecurityDescriptor' attribute in Active Directory, specifically looking for GUIDs associated with DCSync extended rights. Such a modification allows the designated account to perform DCSync attacks, enabling the retrieval of password hashes for any user or computer in the domain.
Detects potential DC Sync attacks, where an adversary mimics a domain controller to request credential data using replication permissions. This rule identifies Event ID 4662 with AccessMask 0x100 and specific replication-related properties, excluding known benign accounts.
Detects scenarios where an attacker use DCSync or SecretDump tool to exfiltrate Active Directory credentials
Detects scenarios where an attacker adds its account into a sensitive Exchange group to obtain "Replicating Directory Changes /all" and perform DCsync attack.
NetSYnc attack
Sigma
NetSync allows an attacker to take the NTLM hash of a Domain Controller (DC) machine account ("usually" identified by ending in "$") and using it to obtain the NTLM machine account hash of another machine account through impersonation (similar to, but different from, DCSync). Where DCSync can obtain user account passwords, NetSync is limited to machine accounts. The other main differentiator between DCSync and NetSync is that DCSync will make use of Microsoft's Directory Replication Service (DRS) Remote Protocol, whereas NetSync uses the older Netlogon Remote Protocol (MS-NRPC)
This analytic detects a user account initiating an Active Directory replication request, indicative of a DCSync attack. It leverages EventCode 4662 from the Windows Security Event Log, focusing on specific object types and replication permissions. This activity is significant because it can allow an attacker with sufficient privileges to request password hashes for any or all users within the domain. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of the entire domain.
The following analytic identifies unauthorized Active Directory replication requests initiated from non-domain controller locations. It leverages EventCode 4662 to detect when a computer account with replication permissions creates a handle to domainDNS, filtering out known domain controller IP addresses. This activity is significant as it may indicate a DCSync attack, where an attacker with privileged access can request password hashes for any or all users within the domain. If confirmed malicious, this could lead to unauthorized access to sensitive information and potential full domain compromise.
Detects potential DCSync attacks by identifying Event ID 4662 where specific DS-Replication access rights are used by a non-domain controller. This rule specifically looks for attempts to replicate directory changes (DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, DS-Replication-Get-Changes-In-Filtered-Set) from an IP address that is not a known domain controller, while also excluding common system accounts.
Detects the use of known malicious PowerShell commandlets often associated with exploitation frameworks. These commandlets perform various adversarial actions such as credential dumping, reconnaissance, persistence, privilege escalation, and data exfiltration.
Detects the execution of known offensive PowerShell scripts used for exploitation or reconnaissance, including tools from PowerSploit, PowerUpSQL, and other common red-teaming frameworks. The rule identifies specific script names and 'Invoke-Sharp' variants within PowerShell module logging data.
Detects well-known credential dumping tools execution via service execution events
Mimikatz DC Sync
Sigma
Detects Mimikatz DC sync security events
Detects well-known credential dumping tools execution via service execution events
Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.
Mimikatz Use
Sigma
This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)
Detection well-known mimikatz command line arguments
Detects well-known credential dumping tools execution via service execution events
' This hunting query looks for process command line activity related to activity observed by Dev-0056.The command lines this query hunts for are used as part of the threat actor's post exploitation activity.
This query uses the Microsoft Sentinel Information Model - https://docs.microsoft.com/azure/sentinel/normalization'
This query uses the Microsoft Sentinel Information Model - https://docs.microsoft.com/azure/sentinel/normalization'
Page 6 of 7