Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
191 detections
Filters
Last updated
All Time
Detection languages
73
47
34
14
10
Contributors
34
34
31
25
23
Categories
99
89
39
36
18
Platforms
182
6
5
3
Products / Services
70
67
32
30
24
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
4
2
IDS Classtypes
2
IDS Protocols
2
2
Detects anomalous, high-frequency cloud management API requests across multiple sensitive paths (such as directory roles, applications, and service principals) from a single account. This pattern is indicative of automated enumeration or discovery of cloud infrastructure, permissions, and identity configurations, which is often a precursor to further exploitation.
Detects anomalous, high-volume reconnaissance activity against multiple Microsoft Graph API endpoints (users, groups, roles, authentication methods, service principals, sites, and drives) by a single identity within a one-hour window. This behavior is indicative of post-compromise enumeration, often associated with threats like UNC6671/Storm-3121.
LDAP Query Extractor | Cortex XDR
Cortex XDR
Extracts LDAP search queries from Microsoft-Windows-LDAP-Client Event ID 30 logs on endpoints. Accepts hostname, username, or IP as input. Shows initiating process with full command line, search filter, base DN, and requested attributes. Good for triaging LDAP enumeration alerts and identifying whether queries come from known AD tools or suspicious recon activity.
Detects Python processes executing common system and network enumeration tools (e.g., net.exe, tasklist.exe, dsquery, Get-ADUser). This activity is indicative of the SynkLoader system profiler module, used to size the victim environment for ransom-value estimation and lateral movement preparation.
Detects AS-REP roasting is an attack that is often-overlooked. It is not very common as you have to explicitly set accounts that do not require pre-authentication.
Detects Python processes executing common system and network enumeration tools (e.g., net.exe, tasklist.exe, dsquery, Get-ADUser). This activity is indicative of the SynkLoader system profiler module, used to size the victim environment for ransom-value estimation and lateral movement preparation.
Detects mass LDAP enumeration queries consistent with a modified BloodHound collector scraping AD users, computers, groups, and GPO/ACL data — customized by CISA's red team to evade static EDR signatures.
Detects reconnaissance patterns associated with SynkLoader, specifically focusing on in-memory PowerShell execution used to harvest system information, user privileges, running services, process listings, and Active Directory computer counts.
Detects pythonw.exe executing from non-standard paths (ProgramData, AppData, or Temp) while loading netapi32.dll or ntdsapi.dll, consistent with the TWINLOOT implant's recon module performing NetAPI-based enumeration of domain controllers, admins, and domain trusts via DsEnumerateDomainTrusts and related calls, as observed being tasked by operators through the SharePoint dead-drop C2 channel.
Detects at least 3 distinct C2Looper-associated discovery commands (ipconfig /all, whoami /all, nltest /dclist, net group /domain "domain admins"/"domain computers", wmic product get name,version, ls, drives) executed by the same parent process within a 60 second window, reducing false positives from isolated legitimate admin usage of any single command.
Detects at least 3 distinct C2Looper-associated discovery commands (ipconfig /all, whoami /all, nltest /dclist, net group /domain "domain admins"/"domain computers", wmic product get name,version) executed by the same parent process within a 60 second window, reducing false positives from isolated legitimate admin usage of any single command.
This KQL detects attack used TCP port 4307 for unauthenticated access and replaced public\js\locale.php with a web shell that provided persistent remote access.
This rule detects hosts exhibiting behavior consistent with an active ransomware or destructive attack in progress, by correlating five distinct attack-chain stages within a rolling 24-hour window: environment/AD enumeration, network share discovery, lateral movement via RDP, credential dumping, and backup/recovery destruction.
Detects in-process LDAP enumeration of Active Directory through the .NET System.DirectoryServices classes, the [adsisearcher] type accelerator and DirectorySearcher, captured from PowerShell ScriptBlock logging in action_evtlog_message. Severity is assigned from the LDAP filter and requested attributes. CRITICAL covers queries after credential-bearing attributes (LAPS, gMSA, sIDHistory, GPP/SYSVOL paths) or DCSync replication rights. HIGH covers known attack-technique targeting: Tier Zero enumeration via adminCount, SPN enumeration for Kerberoasting, delegation attributes, and the UAC bitmask filters used for AS-REP roasting and unconstrained delegation. MEDIUM covers broad estate enumeration across groups, computers, GPOs, and OUs. Command-line context (suspicious parent process, encoded or hidden execution) is surfaced as separate fields for triage rather than folded into the score.
Detects privileged Active Directory enumeration seen on the wire by Corelight, filtered to source hosts that don't appear in the Cortex endpoint inventory. It reads ldap_search records from corelight_zeek_raw, tiers them by the LDAP filter (CRITICAL for credential-attribute and DCSync hunting, HIGH for Tier Zero, Kerberoast, delegation, and UAC-bitmask targeting, MEDIUM for broad group, computer, and GPO enumeration), then joins the source address against endpoints and keeps only the queries whose id_orig_h has no matching managed agent
Detects privileged Active Directory enumeration seen on the wire by Corelight, filtered to source hosts that don't appear in the Cortex endpoint inventory. It reads ldap_search records from corelight_zeek_raw, tiers them by the LDAP filter (CRITICAL for credential-attribute and DCSync hunting, HIGH for Tier Zero, Kerberoast, delegation, and UAC-bitmask targeting, MEDIUM for broad group, computer, and GPO enumeration), then joins the source address against endpoints and keeps only the queries whose id_orig_h has no matching managed agent
Detects in-process LDAP enumeration of Active Directory through the .NET System.DirectoryServices classes, the [adsisearcher] type accelerator and DirectorySearcher, captured from PowerShell ScriptBlock logging in action_evtlog_message. Severity is assigned from the LDAP filter and requested attributes. CRITICAL covers queries after credential-bearing attributes (LAPS, gMSA, sIDHistory, GPP/SYSVOL paths) or DCSync replication rights. HIGH covers known attack-technique targeting: Tier Zero enumeration via adminCount, SPN enumeration for Kerberoasting, delegation attributes, and the UAC bitmask filters used for AS-REP roasting and unconstrained delegation. MEDIUM covers broad estate enumeration across groups, computers, GPOs, and OUs. Command-line context (suspicious parent process, encoded or hidden execution) is surfaced as separate fields for triage rather than folded into the score.
This rule detects potential Active Directory enumeration activity by monitoring ADWS (Active Directory Web Services) port 9389. It captures activity where Microsoft.ActiveDirectory.WebServices.exe is engaged, and correlates this with Windows Event ID 1644, which identifies LDAP queries being executed. The rule specifically looks for local loopback connections often used to proxy and obfuscate the origin of these LDAP queries, helping to identify enumeration patterns that might be intended to hide the source workstation.
Detects anomalous, high-frequency usage of Active Directory PowerShell cmdlets (e.g., Get-ADUser, Get-ADGroup) by a single user or process within a short timeframe, which is a common indicator of internal domain reconnaissance by an adversary.
Detects the use of common 'net' utility commands used by attackers to enumerate local and domain users and groups, such as domain admins or Exchange-specific security groups. This activity is a common indicator of reconnaissance during the post-exploitation phase.
Detects Commandlet names from well-known PowerShell exploitation frameworks
Page 2 of 10