Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
191 detections
Filters
Last updated
All Time
Detection languages
73
47
34
14
10
Contributors
34
34
31
25
23
Categories
99
89
39
36
18
Platforms
182
6
5
3
Products / Services
70
67
32
30
24
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
4
2
IDS Classtypes
2
IDS Protocols
2
2
This rule detects attempts to discover Group Policy settings on a Windows system. It identifies the execution of common command-line interpreters (cmd.exe, powershell.exe, wmic.exe, rundll32.exe) followed by specific commands or PowerShell cmdlets used for GPO enumeration. This includes native Windows commands like 'gpresult' and 'secedit', registry queries for policy settings, and PowerShell cmdlets such as 'Get-GPO' and 'Get-GPResultantSetOfPolicy'. Additionally, it looks for LDAP-related commands or patterns ('ldapsearch', 'groupPolicyContainer') that might indicate GPO discovery via directory services. The rule also correlates these process events with network connections to SYSVOL shares or LDAP ports (389, 636) to further confirm GPO-related activity.
Detects Commandlet names from well-known PowerShell exploitation frameworks
Detects Commandlet names from well-known PowerShell exploitation frameworks
Detects Commandlet names from well-known PowerShell exploitation frameworks
Detects AdFind execution with common flags seen used during attacks
Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.
Detects scenarios where an attacker attempts to enumerate local or domain groups via commandline.
Detects scenarios where an attacker enumerates domain group with tools like CME (--groups).
Detects scenarios where an attacker attempts to enumerate sensitive domain group settings and membership.
The analytic identifies the execution of `dsquery.exe` with command-line arguments used to query for domain groups. This activity is significant because both Red Teams and adversaries use `dsquery.exe` to enumerate domain groups, gaining situational awareness and facilitating further Active Directory discovery. If confirmed malicious, this behavior could allow attackers to map out the domain structure, identify high-value targets, and plan subsequent attacks, potentially leading to privilege escalation or data exfiltration.
This hunting rule searches for incoming ADWS connections on Domain Controllers from IP Addresses that cannot be linked to Microsoft Defender for Endpoint (MDE) onboarded devices. It aims to detect enumeration activities using ADWS from unmanaged or unknown devices, which might bypass typical monitoring tools.
Detects the dual-use tool ADExplorer writing a complete Active Directory snapshot into a .dat file. This activity can be leveraged by attackers for various purposes, including data extraction for tools like Bloodhound, gathering usernames for password spraying attacks, or utilizing metadata for social engineering. While the snapshot typically does not contain password hashes, there have been instances where administrators inadvertently stored passwords in comment fields within Active Directory, which could then be exposed through such snapshots.
Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag to save a local copy of the Active Directory database. This activity is suspicious as it can be used by attackers to extract data for Bloodhound, gather usernames for password spraying, or obtain metadata for social engineering. While the snapshot typically doesn't contain password hashes, administrators sometimes store passwords in comment fields, which could be exposed.
Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag to create a local copy of the Active Directory database. This activity can be used by attackers for various purposes, including extracting data for Bloodhound, gathering usernames for password spraying, or leveraging metadata for social engineering. While the snapshot does not contain password hashes, administrators sometimes store passwords in comment fields, which could be exposed.
Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.
Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.
Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database to a suspicious directory. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.
The following analytic detects the execution of PowerShell commands used for domain enumeration, such as `get-netdomaintrust` and `get-adgroupmember`. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command sent to PowerShell. This activity is significant as it often indicates reconnaissance efforts by an attacker to map out the domain structure and identify key users and groups. If confirmed malicious, this behavior could lead to further targeted attacks, privilege escalation, and unauthorized access to sensitive information within the domain.
Detects potential Active Directory enumeration via LDAP. This rule identifies suspicious LDAP search filters and distinguished name enumerations that are commonly used by reconnaissance tools like PowerView and SharpHound to gather information about users, groups, computers, and domain trusts within an Active Directory environment. The rule specifically looks for various 'groupType', 'sAMAccountType', 'objectCategory', 'objectClass', 'primaryGroupID', 'userAccountControl' attributes, and specific distinguished names or flags that indicate detailed AD reconnaissance.
Detects Commandlet names from well-known PowerShell exploitation frameworks
Detects Commandlet names from well-known PowerShell exploitation frameworks
Page 6 of 10