Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
191 detections
Filters
Last updated
All Time
Detection languages
73
47
34
14
10
Contributors
34
34
31
25
23
Categories
99
89
39
36
18
Platforms
182
6
5
3
Products / Services
70
67
32
30
24
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
4
2
IDS Classtypes
2
IDS Protocols
2
2
This rule monitors for the execution of common reconnaissance, enumeration, and scanning tools often used in post-exploitation scenarios. It detects the usage of scanners like fscan, network discovery utilities like net.exe, nltest, dsquery, and credential/directory enumeration tools like SharpHound. These tools are commonly used for domain discovery, network mapping, and collecting information for lateral movement or privilege escalation.
Detects Active Directory domain group enumeration activities associated with StrikeShark post-compromise tooling. The rule monitors for Event ID 4661 object access requests to domain groups with specific access masks, as well as the execution of reconnaissance commands via net.exe or the usage of SharpGPOAbuse.exe, which are known indicators of StrikeShark operations.
Detects execution of common reconnaissance commands spawned by the AdgNsy.exe process, identified as an AdaptixC2 beacon. This behavior indicates post-exploitation discovery activity.
Detects the execution of known Active Directory discovery tools, specifically 'adfind.exe' or 'dsquery.exe' with arguments targeting user or group enumeration. These tools are commonly used by adversaries during the reconnaissance phase to map domain structure.
Detects post-compromise Active Directory reconnaissance activities using net.exe or wmic.exe to enumerate domain users, groups, computers, and sessions. The rule identifies anomalous behavior by monitoring for at least 3 distinct reconnaissance categories triggered by common scripting interpreters (PowerShell, cmd, pythonw, or node.exe) within a 5-minute window.
Detects specific object access (EventID 4662) targeting sensitive Active Directory objects, including Domain Admin, Enterprise Admin, or other high-value security principal containers. These GUIDs are associated with common Active Directory enumeration or exploitation techniques used to identify critical infrastructure or perform reconnaissance.
Detects reconnaissance activity targeting Active Directory group structures and membership, utilizing common administrative tools such as net.exe, PowerShell, and dsquery. This rule identifies patterns associated with domain group discovery and identification of privileged accounts.
Detects the execution of PowerShell commands commonly used for host reconnaissance (e.g., whoami, ipconfig, net group, systeminfo) combined with the use of PowerShell to perform an HTTP POST request to a suspicious external IP address (202.182.102.5), suggesting post-compromise reconnaissance data exfiltration.
Detects the execution of specific Python scripts associated with the FortiBleed campaign. These scripts include 'spray_da.py' for domain admin password spraying, 'smb_test.py' for SMB validation and lateral movement, 'spider.py' for Active Directory crawling, and 'ad_full_audit.py' for Active Directory auditing. Detection is based on the Python interpreter executing these specific script filenames.
Detects the use of the StrikeShark 'Searchall' reconnaissance tool for enumerating domain groups, as well as native Windows 'net' commands and PowerShell cmdlets ('Get-ADGroupMember') used to query sensitive Active Directory groups such as Domain Admins and Enterprise Admins.
Detects execution of SharpHound (BloodHound) for Active Directory enumeration and subsequent exfiltration of collected datasets, specifically tracking activity attributed to the MexicanMafia (Operation Escaneo).
This rule detects the execution of the BloodHound or SharpHound Active Directory enumeration tools by monitoring for specific process names, command-line arguments associated with the tool's common flags (e.g., --CollectionMethod, --ZipFileName), and file paths containing these tool names.
Detects the execution of known Active Directory discovery tools, specifically 'adfind.exe' or 'dsquery.exe' with arguments targeting user or group enumeration. These tools are commonly used by adversaries during the reconnaissance phase to map domain structure.
Detects the execution of net.exe or net1.exe with command line arguments used to enumerate domain users, domain groups, or local administrators. This pattern is commonly used by adversaries for discovery of accounts and permission groups within a Windows environment.
Detects the execution of net.exe or net1.exe with command line arguments used to enumerate domain users, domain groups, or local administrators. This pattern is commonly used by adversaries for discovery of accounts and permission groups within a Windows environment.
Detects the use of net.exe and dsquery.exe to enumerate domain user accounts and domain groups. Adversaries often perform this reconnaissance to identify target accounts or privileged groups within an Active Directory environment.
Detects the usage of net.exe or net1.exe to enumerate domain users, groups, local administrators, and domain controllers, which is frequently indicative of post-compromise reconnaissance.
This rule detects potential Active Directory enumeration attempts by monitoring for the execution of common command-line tools and PowerShell cmdlets used to query domain information, such as users, groups, and domain controllers.
Detects common reconnaissance activities using built-in Windows utilities to enumerate domain users, domain groups, and local administrators, as well as LDAP enumeration using dsquery and dsget.
Detects high-frequency execution of common Windows reconnaissance tools such as net.exe, nltest.exe, and dsquery.exe, often used by attackers for account or domain enumeration. The rule filters out known administrative processes and Microsoft-signed binaries to reduce noise.
Detects the use of the SharpGPOAbuse tool, typically used for modifying Group Policy Objects for persistence or privilege escalation, in conjunction with rapid Active Directory group enumeration (using net.exe or net1.exe) on the same host within a 5-minute window. This behavior is highly indicative of an adversary performing post-exploitation reconnaissance and privilege escalation activities.
Page 4 of 10