Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
104 detections
Filters
Last updated
All Time
Detection languages
46
22
12
8
7
Contributors
23
15
8
7
5
Categories
37
25
21
21
16
Platforms
72
14
6
3
3
Products / Services
54
35
7
7
6
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
3
3
1
1
1
IDS Classtypes
3
IDS Protocols
3
This rule detects an anomaly in Kerberos authentication attempts by monitoring TCP traffic to port 88 (Kerberos). It triggers an alert if a source IP address attempts Kerberos authentication 30 or more times within a 10-second window, indicating a potential brute-force or rapid authentication attempt against a domain account.
This rule detects LDAP bind requests originating from an external source to a domain controller (port 389) within the home network. It specifically looks for the 'bindRequest' content in TCP traffic and triggers an alert if 10 such requests are observed from the same source within a 30-second window. This could indicate an attempt to enumerate or authenticate against directory services from outside the internal network, potentially as part of initial access or reconnaissance.
Detect remote login by Administrator user (depending on internal pattern).
Detects when an instance identity has taken an action that isn't inside SSM.
This can indicate that a compromised EC2 instance is being used as a pivot point.
This can indicate that a compromised EC2 instance is being used as a pivot point.
Detects the creation of a dMSA service account using the New-ADServiceAccount cmdlet in certain OUs.
The fact that the cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious.
It is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
On top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions,
it is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.
The fact that the cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious.
It is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
On top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions,
it is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.
Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts.
This command line pattern could be an indicator an attempt to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
This command line pattern could be an indicator an attempt to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
Detects the creation of a dMSASvc account using the New-ADServiceAccount cmdlet in certain OUs.
The fact that the Cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious.
It is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
On top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions,
it is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.
The fact that the Cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious.
It is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
On top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions,
it is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.
On March 11, 2026, the global medical technology giant Stryker experienced a severe cyberattack when Iranian-linked hackers called Handala Hack affiliated with Iranian Ministry of Intelligence and Security (MOIS) used wiper malware to permanently erase data from its network. Based On the List of IOC’s seen from the previous attacks from the threat group I’ve done threat hunt.
On March 11, 2026, the global medical technology giant Stryker experienced a severe cyberattack when Iranian-linked hackers called Handala Hack affiliated with Iranian Ministry of Intelligence and Security (MOIS) used wiper malware to permanently erase data from its network. Based On the List of IOC’s seen from the previous attacks from the threat group I’ve done threat hunt.
On March 11, 2026, the global medical technology giant Stryker experienced a severe cyberattack when Iranian-linked hackers called Handala Hack affiliated with Iranian Ministry of Intelligence and Security (MOIS) used wiper malware to permanently erase data from its network. Based On the List of IOC’s seen from the previous attacks from the threat group I’ve done threat hunt.
On March 11, 2026, the global medical technology giant Stryker experienced a severe cyberattack when Iranian-linked hackers called Handala Hack affiliated with Iranian Ministry of Intelligence and Security (MOIS) used wiper malware to permanently erase data from its network. Based On the List of IOC’s seen from the previous attacks from the threat group I’ve done threat hunt.
On March 11, 2026, the global medical technology giant Stryker experienced a severe cyberattack when Iranian-linked hackers called Handala Hack affiliated with Iranian Ministry of Intelligence and Security (MOIS) used wiper malware to permanently erase data from its network. Based On the List of IOC’s seen from the previous attacks from the threat group I’ve done threat hunt.
Detects the creation of a new computer account (Event ID 4741) where the creating user is a known service account used by FortiGate appliances. Attackers who compromise FortiGate devices can steal embedded LDAP credentials and use them to join rogue workstations to the domain, leveraging the `mS-DS-MachineAccountQuota` attribute.
Detects execution of net.exe/net1.exe to create a new domain account, potentially initiated by a compromised BeyondTrust/Bomgar process.
Detects a high volume of Kerberos pre-authentication failures (Event ID 4771, Status 0x18) against multiple distinct user accounts originating from a single source IP address within a short time window. This behavior is characteristic of password spraying attacks where an attacker attempts a small number of common passwords across many accounts to avoid lockouts and detection in a Windows Active Directory environment.
Detects privileged credential retrieval from Privileged Access Management (PAM) solutions via PowerShell, including CyberArk AIM, Thycotic, HashiCorp Vault
Detects any authentication activity (successful or failed) for emergency break-glass administrative accounts
Detects when an instance identity has taken an action that isn't inside SSM.
This can indicate that a compromised EC2 instance is being used as a pivot point.
This can indicate that a compromised EC2 instance is being used as a pivot point.
This rule detects successful remote logons by users whose usernames start with 'Admin' (e.g., Administrator, Admin-SQL) on Windows systems. It specifically looks for Event ID 4624 (successful logon), Logon Type 10 (RemoteInteractive), and the Negotiate authentication package. The rule aims to identify potential misuse of administrative accounts for remote access, which could indicate privilege escalation, persistence, or lateral movement. Its effectiveness relies on an internal pattern for administrator usernames and a policy mandating that these accounts are only used as secondary accounts.
Detects scenarios where a user of a predefined set of group(s) logs on a target machine.
Detects scenarios where an attacker rename a non admin account in order to evade SOC & operations vigilance
Page 4 of 5