Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
181 detections
Filters
Last updated
All Time
Detection languages
85
37
28
9
8
Contributors
36
26
25
25
13
Categories
97
93
36
26
20
Platforms
159
14
10
3
2
Products / Services
48
45
25
19
17
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
2
2
1
1
IDS Classtypes
3
3
2
IDS Protocols
5
3
This rule detects PowerShell script blocks that utilize the `System.DirectoryServices.DirectorySearcher` object to enumerate Active Directory for computer objects. Specifically, it looks for the creation of this object, the addition of properties to load (like 'name'), and the execution of `findall()` to retrieve results. This behavior is indicative of an attacker attempting to discover domain-joined computers within an Active Directory environment.
Detects the execution of AdFind with command-line flags commonly associated with reconnaissance activities during attacks. AdFind is a legitimate tool that can be abused by adversaries to gather extensive information about Active Directory environments, including domain trusts, user accounts, computer objects, and group policies.
Detects the usage of the 'Get-AdComputer' PowerShell cmdlet to enumerate computer objects or their properties within Active Directory. This activity is often performed during the discovery phase of an attack to map out the network environment.
Detects attempts to enumerate file shares, printer shares, and sessions using the 'net.exe' or 'net1.exe' utility with the 'view' flag. This activity is often performed by adversaries for remote system discovery.
Detects the enumeration of other remote systems.
Cisco Discovery
Sigma
Find information about network devices that is not stored in config files
Detects usage of the "Get-AdGroup" cmdlet to enumerate Groups within Active Directory
Nltest.EXE Execution
Sigma
Detects nltest commands that can be used for information discovery
Detects the enumeration of other remote systems.
Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.
This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks Python 3 and python.exe must be installed,
Usee to Query/modify DNS records for Active Directory integrated DNS via LDAP
Usee to Query/modify DNS records for Active Directory integrated DNS via LDAP
This YARA rule detects various components and behaviors associated with the BlackBasta ransomware. It identifies specific byte patterns related to file discovery, encryption routines (multiple versions), command prompt execution, LDAP connection attempts, dropping of ransom notes, and exclusion logic for files/volumes from encryption. The rule is designed to catch the ransomware executable itself based on these unique code signatures.
This rule detects the Networm ransomware by identifying specific byte patterns associated with its file encryption routines, remote connection capabilities, and file discovery mechanisms. The rule looks for a combination of these patterns within executable files, indicating the presence of the ransomware.
Page 9 of 9