Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
191 detections
Filters
Last updated
All Time
Detection languages
73
47
34
14
10
Contributors
34
34
31
25
23
Categories
99
89
39
36
18
Platforms
182
6
5
3
Products / Services
70
67
32
30
24
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
4
2
IDS Classtypes
2
IDS Protocols
2
2
Detects the use of the Sysinternals ADExplorer tool for Active Directory environment exploration, including the creation of snapshots or data dumps, as well as the use of the native 'net' utility to enumerate domain users and groups. These activities are common indicators of internal reconnaissance and discovery phases during an attack.
Detects the use of ADExplorer with the snapshot command to create Active Directory database snapshots, or the usage of 'net user' and 'net group' commands with the /domain argument. These techniques are commonly used by attackers to enumerate Active Directory users and groups to identify high-value targets within a domain.
Detects high-volume LDAP queries targeting sensitive Active Directory attributes such as userAccountControl, adminCount, and objectCategory. This behavior is indicative of automated directory enumeration tools like SharpHound or BloodHound performing reconnaissance to identify high-value targets or privileged accounts.
Detects suspicious PowerShell activity using Active Directory enumeration cmdlets (e.g., Get-ADUser, Get-ADComputer, Get-DnsServerZone) that outputs results into CSV or text files within the C:\ProgramData directory. This pattern is commonly used during reconnaissance and staging for data exfiltration by threat actors.
This rule detects potential automated reconnaissance or credential harvesting by monitoring for high volumes of LDAP queries targeting sensitive Active Directory attributes. It correlates both LDAP query events and Windows Security Event ID 4662 to identify bulk access to attributes like 'samAccountName', 'userPassword', and 'memberOf'.
Detects high-volume LDAP queries targeting sensitive Active Directory attributes such as userAccountControl, adminCount, and objectCategory. This behavior is indicative of automated directory enumeration tools like SharpHound or BloodHound performing reconnaissance to identify high-value targets or privileged accounts.
Detects reconnaissance activities targeting Active Directory, specifically focusing on the use of common enumeration tools like net.exe, net1.exe, and BloodHound/SharpHound binaries. The rule triggers when multiple enumeration commands or tool-specific execution artifacts are observed, suggesting preparation for lateral movement or privilege escalation.
Detects frequent execution of common Active Directory enumeration tools (such as BloodHound/SharpHound, AdFind) and suspicious LDAP attribute queries targeting sensitive AD information (e.g., group membership, service principal names). The rule triggers when an individual user performs more than three such operations within the aggregation window.
Detects the use of native Windows commands 'net.exe' and 'net1.exe' to perform domain group or user enumeration, as well as the execution of 'ADExplorer.exe' (a known tool for viewing and editing Active Directory objects). These activities are commonly associated with the reconnaissance phase of an attack to map network infrastructure and identify privileged accounts.
This rule detects potential automated reconnaissance or credential harvesting by monitoring for high volumes of LDAP queries targeting sensitive Active Directory attributes. It correlates both LDAP query events and Windows Security Event ID 4662 to identify bulk access to attributes like 'samAccountName', 'userPassword', and 'memberOf'.
Detects reconnaissance activity targeting Active Directory infrastructure using common discovery tools such as AdFind, BloodHound/SharpHound, dsquery, nltest, and native net commands. The rule identifies suspicious patterns by correlating multiple executions or flagging the use of known adversarial enumeration binaries, monitoring for commands that specifically target domain domain-wide information, trust relationships, or domain groups.
Detects the use of the 'net.exe' or 'net1.exe' utilities with the 'group' and '/domain' arguments, indicating an attempt to query domain-level groups. This technique is commonly used by attackers during the discovery phase to map out domain security groups.
Detects reconnaissance activity targeting Active Directory environment information. The rule monitors for common command-line patterns associated with group enumeration, such as the use of 'net' commands for domain group queries, execution of AD enumeration tools like SharpHound/BloodHound, and PowerView PowerShell cmdlets.
This rule detects the execution of common enumeration commands (net, dsquery) on systems identified as Domain Controllers. These commands are frequently used by adversaries for reconnaissance to identify local or domain users and groups after gaining access to a host.
Detects common reconnaissance activities using built-in Windows utilities to enumerate domain users, domain groups, and local administrators, as well as LDAP enumeration using dsquery and dsget.
Detects the execution of known Active Directory enumeration tools such as AdFind and BloodHound/SharpHound, or manual net group domain queries, executed on hosts that may lack standard EDR instrumentation. This pattern is commonly associated with adversary lateral movement and reconnaissance in ransomware affiliate operations.
Detects malicious activities associated with Akira ransomware affiliates, including Active Directory enumeration using AdFind, data staging via WinRAR, and exfiltration attempts utilizing tools like WinSCP, rclone, or MEGAcmd. The rule also monitors for the presence of campaign-specific malware binaries.
Detects common tools and techniques used for Active Directory reconnaissance, including domain trust discovery, user and group enumeration, and computer discovery. The rule monitors for the execution of utilities like net.exe, nltest, AdFind, SharpHound, and PowerShell cmdlets associated with Active Directory modules, as well as the opening of files containing reconnaissance output.
Detects the execution of known Active Directory enumeration tools (BloodHound/SharpHound, AdFind) and command-line techniques (net group /domain, PowerView cmdlets) that are frequently associated with reconnaissance activities by threat actors like Akira affiliates, particularly when initiated from non-standard or unmanaged endpoints.
This rule detects the execution of common enumeration commands (net, dsquery) on systems identified as Domain Controllers. These commands are frequently used by adversaries for reconnaissance to identify local or domain users and groups after gaining access to a host.
Detects post-compromise activity where an adversary enumerates Domain Admins group memberships using standard Windows utilities (net, net1, nltest, or PowerShell) immediately followed by the use of curl to exfiltrate data via HTTP POST requests to suspicious external infrastructure.
Page 3 of 10