Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
191 detections
Filters
Last updated
All Time
Detection languages
73
47
34
14
10
Contributors
34
34
31
25
23
Categories
99
89
39
36
18
Platforms
182
6
5
3
Products / Services
70
67
32
30
24
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
4
2
IDS Classtypes
2
IDS Protocols
2
2
The following analytic identifies the use of Ldifde.exe, a command-line utility for creating, modifying, or deleting LDAP directory objects. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution and command-line arguments. Monitoring Ldifde.exe is significant because it can be used by attackers to manipulate directory objects, potentially leading to unauthorized changes or data exfiltration. If confirmed malicious, this activity could allow an attacker to gain control over directory services, escalate privileges, or access sensitive information within the network.
The following analytic detects the execution of `wmic.exe` with command-line arguments querying specific elevated domain groups. It leverages Endpoint Detection and Response (EDR) telemetry to identify processes that access the LDAP namespace and search for groups like "Domain Admins" or "Enterprise Admins." This activity is significant as it indicates potential reconnaissance efforts by adversaries to identify high-privilege accounts within Active Directory. If confirmed malicious, this behavior could lead to privilege escalation, allowing attackers to gain elevated access and control over critical network resources.
This analytic detects the execution of `powershell.exe` with the `Get-AdGroup` commandlet, which is used to query domain groups in a Windows Domain. This activity may indicate an adversary or Red Team enumerating domain groups for situational awareness and Active Directory discovery. If confirmed malicious, this activity could lead to further reconnaissance, privilege escalation, or lateral movement within the network.
This analytic detects executables running from public or temporary locations that are communicating over Windows domain authentication ports/protocols such as LDAP (389), LDAPS (636), and Kerberos (88). It leverages network traffic data to identify processes originating from user-controlled directories. This activity is significant because legitimate applications rarely run from these locations and attempt domain authentication, making it a potential indicator of compromise. If confirmed malicious, attackers could leverage this to access domain resources, potentially leading to further exploitation and lateral movement within the network.
This analytic identifies the execution of `powershell.exe` with command-line arguments used to query domain groups via the `Get-WmiObject` cmdlet and the `-class ds_group` parameter. This activity indicates potential reconnaissance efforts by adversaries to enumerate domain groups, which is a common step in Active Directory Discovery. If confirmed malicious, this could allow attackers to gain insights into the domain structure, aiding in further attacks and privilege escalation.
The analytic detects the execution of `powershell.exe` with command-line arguments that query for domain groups using `Get-DomainGroup`. This activity is often associated with PowerView, a tool used by adversaries for domain enumeration and situational awareness. Detecting this can help identify attackers gaining insights into domain group structures, which could aid in further exploitation and privilege escalation.
Identify the enumeration of both the users and members of groups in the Entra ID tenant. While these are two separate functions in GraphRunner, they are often run in support of one another.
This rule detects the execution of BloodHound and SharpHound, which are reconnaissance tools used to map Active Directory environments. It identifies these tools by their product name, description, company name, executable image names, and specific command-line arguments often used for data collection, such as 'CollectionMethod All', '--Loop', '--PortScanTimeout', '-JsonFolder', '-ZipFileName', 'DCOnly', and '--NoSaveCache', as well as PowerShell cmdlets like 'Invoke-Bloodhound' and 'Get-BloodHoundData'.
Detects the execution of 'net.exe' or 'net1.exe' with command-line arguments commonly used for discovery activities related to accounts, groups, shares, and services. This rule aims to identify potential reconnaissance or privilege escalation attempts.
This rule detects the creation of specific files that are commonly generated by the BloodHound collection tool, SharpHound. These files, such as 'BloodHound.zip', '_computers.json', '_domains.json', '_groups.json', and others, contain collected Active Directory information. The presence of these files on a system indicates that BloodHound or SharpHound has been used for reconnaissance, which is often a precursor to further malicious activity within an Active Directory environment.
Detects reconnaissance activity involving attempts to enumerate domain administrator accounts and domain groups. Specifically, it looks for Event ID 4661 (An operation was performed on an object) with an AccessMask of '0x2d' (which indicates a read access attempt) on SAM_USER or SAM_GROUP objects whose ObjectName corresponds to well-known SIDs for the built-in Administrator account (-500) or Domain Admins group (-512) within a domain (S-1-5-21- prefix). This activity is often associated with adversaries using commands like 'net user administrator /domain' or 'net group domain admins /domain' to discover privileged accounts.
Detects the execution of AdFind with command-line flags commonly associated with reconnaissance activities during attacks. AdFind is a legitimate tool that can be abused by adversaries to gather extensive information about Active Directory environments, including domain trusts, user accounts, computer objects, and group policies.
This rule detects attempts to enumerate Active Directory groups and user properties using specific PowerShell cmdlets. It looks for the use of 'get-ADPrincipalGroupMembership' to identify group memberships and 'get-aduser' with specific parameters ('-f', '-pr', 'DoesNotRequirePreAuth') which can be used to discover user attributes relevant for privilege escalation or further reconnaissance. This activity is often performed by adversaries to map out the domain environment and identify accounts with elevated privileges.
This rule detects the use of the 'Get-AdGroup' PowerShell cmdlet with the '-Filter' parameter to enumerate groups within Active Directory. This activity is often performed by attackers during the discovery phase to identify privileged groups and users.
This rule detects PowerShell script blocks that enumerate Active Directory groups or users. Specifically, it looks for the use of `Get-ADPrincipalGroupMembership` to retrieve group memberships or a combination of `Get-ADUser`, filtering (`-f`), property selection (`-pr`), and the `DoesNotRequirePreAuth` attribute, which can be used to identify users with specific authentication properties. Adversaries often perform such discovery to identify privileged accounts or understand the domain structure for further exploitation.
Detects activity as "net user administrator /domain" and "net group domain admins /domain"
Detects usage of the "Get-AdGroup" cmdlet to enumerate Groups within Active Directory
Adversaries may attempt to find domain-level groups and permission settings.
The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group.
Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.
The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group.
Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.
Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and
to identify potential systems of interest for Lateral Movement.
Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
to identify potential systems of interest for Lateral Movement.
Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Adversaries may attempt to find domain-level groups and permission settings.
The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group.
Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.
The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group.
Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.
Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as
a precursor for Collection and to identify potential systems of interest for Lateral Movement.
Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
a precursor for Collection and to identify potential systems of interest for Lateral Movement.
Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Page 9 of 10