Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
104 detections
Filters
Last updated
All Time
Detection languages
46
22
12
8
7
Contributors
23
15
8
7
5
Categories
37
25
21
21
16
Platforms
72
14
6
3
3
Products / Services
54
35
7
7
6
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
3
3
1
1
1
IDS Classtypes
3
IDS Protocols
3
Detects successful administrative logins to VMware ESXi, vCenter, or related VDI infrastructure (Horizon) by users who have recently performed a password or MFA reset. This pattern is indicative of a helpdesk-based social engineering attack (vishing) or credential compromise where the attacker regains account access and immediately pivots to critical virtualization management infrastructure to facilitate ransomware deployment.
Aggregates password/MFA reset actions by the performing helpdesk identity, alerting on abnormal reset volume or resets outside a normal ticket pattern — a proxy for a support agent being repeatedly socially engineered or a fraudulent-ticket abuse pattern.
Detects instances where a service account (indicated by a trailing $ in the username, excluding computer accounts) authenticates to three or more distinct hosts within a short time frame. This behavior is indicative of potential lateral movement or automated discovery activities using a compromised service credential.
This rule detects potential lateral movement by monitoring successful network logons using NTLM authentication across multiple distinct destination hosts within a short time window. It calculates the frequency of connections to unique hosts to identify anomalous, rapid traversal through a network by a single user account, excluding known system accounts.
This rule detects modifications to the security descriptors (ACLs) of sensitive Active Directory objects, specifically targeting additions of powerful rights like GenericAll, GenericWrite, WriteDacl, or ForceChangePassword. Monitoring these changes on privileged objects such as Domain Admins, Enterprise Admins, and Domain Controllers is critical for detecting potential privilege escalation or persistence efforts.
Detects a pattern of multiple failed authentication attempts (brute force) from an external IP address followed by a successful authentication event on remote access services such as RDP, VPN, or NTLM. The rule filters for non-private IP addresses and flags successes occurring outside of standard business hours.
Detects user account logins following a recent MFA registration (within 1 to 30 days) combined with subsequent network activity that utilizes node.js applications to query the Microsoft Graph API, which may indicate account takeover or malicious persistence setup.
This rule detects modifications to the security descriptors (ACLs) of sensitive Active Directory objects, specifically targeting additions of powerful rights like GenericAll, GenericWrite, WriteDacl, or ForceChangePassword. Monitoring these changes on privileged objects such as Domain Admins, Enterprise Admins, and Domain Controllers is critical for detecting potential privilege escalation or persistence efforts.
Detects an authentication event followed by a computer account change event (Event ID 4742) targeting a domain controller computer account. This pattern may indicate unauthorized modifications to domain controller machine accounts, which is often associated with persistence or privilege escalation attempts.
This rule detects modifications to the security descriptors (ACLs) of sensitive Active Directory objects, specifically targeting additions of powerful rights like GenericAll, GenericWrite, WriteDacl, or ForceChangePassword. Monitoring these changes on privileged objects such as Domain Admins, Enterprise Admins, and Domain Controllers is critical for detecting potential privilege escalation or persistence efforts.
Detects instances where an Azure AD Connect or MSOL synchronization account performs directory replication actions (DS-Replication-Get-Changes) from a host or at a time inconsistent with its 14-day established baseline. The rule further correlates these anomalies with Azure Audit logs or AzureActivity entries associated with the identity to identify potential cloud-originated abuse or credential compromise.
Detects a pattern of multiple failed authentication attempts (brute force) from an external IP address followed by a successful authentication event on remote access services such as RDP, VPN, or NTLM. The rule filters for non-private IP addresses and flags successes occurring outside of standard business hours.
Detects successful logon events (Event ID 4624) utilizing Schannel (TLS client certificate) or PKU2U (peer authentication) logon processes. This behavior may indicate an attacker using forged or stolen certificates to authenticate against a system, potentially bypassing Kerberos-based authentication monitoring.
This rule detects modifications to the security descriptors (ACLs) of sensitive Active Directory objects, specifically targeting additions of powerful rights like GenericAll, GenericWrite, WriteDacl, or ForceChangePassword. Monitoring these changes on privileged objects such as Domain Admins, Enterprise Admins, and Domain Controllers is critical for detecting potential privilege escalation or persistence efforts.
Detects ESC1-style ADCS certificate enrollment where a requester supplies an arbitrary SAN on a misconfigured template (CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT), enabling impersonation of any account. CISA's red team used this to certify a rogue machine account.
Detects a pattern of multiple failed authentication attempts (brute force) from an external IP address followed by a successful authentication event on remote access services such as RDP, VPN, or NTLM. The rule filters for non-private IP addresses and flags successes occurring outside of standard business hours.
Detects the creation of a new domain user followed by its addition to sensitive, high-privileged groups (e.g., Domain Admins, Enterprise Admins) using the native Windows net.exe or net1.exe utilities. This pattern aligns with known post-compromise activity observed in campaigns like Bumblebee, AdaptixC2, and Akira ransomware, where attackers create stealthy, elevated accounts (e.g., masquerading as backup service accounts) to maintain persistence and full domain control.
Detects the use of net.exe or net1.exe to interact with administrator accounts, specifically looking for attempts to hardcode passwords in the command line or enabling/modifying domain accounts. This is a common pattern for local account persistence, privilege escalation, or lateral movement.
This query is a comprehensive set of KQL (Kusto Query Language) scripts designed for threat hunting in Windows DNS environments. It leverages data from ASimDnsActivityLogs and SecurityEvent to detect various suspicious activities and potential security threats related to DNS operations.
This rule detects potentially malicious activity against accounts classified as having a high blast radius. It correlates three stages of behavior: observed failed authentication attempts (brute force) against a high-blast-radius account, a password reset for that same account, and a subsequent successful logon outside of standard business hours (using Logon Types 3 or 10). The rule uses a password reset event as the mandatory anchor and flags suspicious sequences of events leading up to or following this change.
This query is a comprehensive set of KQL (Kusto Query Language) scripts designed for threat hunting in Windows DNS environments. It leverages data from ASimDnsActivityLogs and SecurityEvent to detect various suspicious activities and potential security threats related to DNS operations.
Page 2 of 5