Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
104 detections
Filters
Last updated
All Time
Detection languages
46
22
12
8
7
Contributors
23
15
8
7
5
Categories
37
25
21
21
16
Platforms
72
14
6
3
3
Products / Services
54
35
7
7
6
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
3
3
1
1
1
IDS Classtypes
3
IDS Protocols
3
This rule audits the state of service accounts in the environment by counting total, enabled, and disabled service accounts. This helps in identifying unused or stale service accounts, ensuring only necessary service accounts are active to reduce the attack surface, and supporting compliance and security posture assessments.
This rule identifies accounts that have been assigned administrative roles within the environment. It helps assess exposure risk by focusing on identities with elevated permissions, supports attack surface reduction by auditing role assignments, and enables proactive threat hunting for potential misuse of admin privileges.
This rule identifies all enabled service accounts in the environment. The goal is to audit the state of service accounts to identify unused or stale accounts, ensure only necessary service accounts are active, reduce the attack surface, and support compliance and security posture assessments. While not directly detecting malicious activity, it provides crucial visibility for security hygiene and can help identify potential accounts that could be abused by adversaries for persistence or defense evasion.
This rule identifies all service accounts in the environment by querying IdentityInfo logs. The goal is to audit the state of these accounts, helping to identify unused or stale service accounts (especially if disabled), ensure only necessary service accounts are active to reduce the attack surface, and support compliance and security posture assessments. This rule does not detect malicious activity but rather provides an inventory for security auditing.
KQL Query
KQL Query from file: Identity Blast Radius 2
KQL Query
SPL Query from file: Failed Authentication to Non-existing Accounts
This analytic detects the execution of PowerView PowerShell cmdlets `Get-ObjectAcl` or `Get-DomainObjectAcl`, which are used to enumerate Access Control List (ACL) permissions for Active Directory objects. It leverages Event ID 4104 from PowerShell Script Block Logging to identify this activity. This behavior is significant as it may indicate an attempt to discover weak permissions in Active Directory, potentially leading to privilege escalation. If confirmed malicious, attackers could exploit these permissions to gain unauthorized access or escalate their privileges within the network.
Detect remote login by Administrator user (depending on internal pattern).
'Identifies when a recently created Group was added to a privileged built in domain local group or global group such as the Enterprise Admins, Cert Publishers or DnsAdmins. Be sure to verify this is an expected addition.
References: For AD SID mappings - https://docs.microsoft.com/windows/security/identity-protection/access-control/active-directory-security-groups.'
References: For AD SID mappings - https://docs.microsoft.com/windows/security/identity-protection/access-control/active-directory-security-groups.'
'This query detects domain user accounts creation (event ID 4720) where the username ends with $.
Accounts that end with $ are normally domain computer accounts and when they are created the event ID 4741 is generated instead.
Ref: https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights.html'
Accounts that end with $ are normally domain computer accounts and when they are created the event ID 4741 is generated instead.
Ref: https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights.html'
This query finds the 10 latest logons performed by email recipients within 30 minutes after they received known malicious emails. You can use this query to check whether the accounts of the email recipients have been compromised.
// Detect Active Directory service accounts that are not active because their last logon was more than 14 days ago
// Replace XXX on line 4 with the naming convention start of your Active Directory service accounts
// Replace XXX on line 4 with the naming convention start of your Active Directory service accounts
The analytic detects the creation of a new Group Policy Object (GPO) by leveraging Windows Event IDs 5136 and 5137. These directory service change events indicate when a new GPO is created. Monitoring GPO creation is critical because adversaries can exploit GPOs to escalate privileges or deploy malware across an Active Directory network. Malicious GPO creation could allow attackers to control system configurations, deploy ransomware, or propagate malware, leading to widespread compromise and significant operational disruption.
This analytic detects suspicious Kerberos Service Ticket (TGS) requests where the requesting account name matches the service name. This behavior is indicative of an exploitation attempt of CVE-2021-42278 and CVE-2021-42287, often referred to as sAMAccountName spoofing. The detection leverages Windows Event ID 4769 from Domain Controllers. Such activity is significant as it may represent an adversary attempting to escalate privileges by impersonating a domain controller, which could lead to complete domain compromise and unauthorized access to sensitive information.
This analytic identifies user accounts experiencing an excessive number of lockouts within a short timeframe. It leverages the 'Change' data model, specifically focusing on events where the result indicates a lockout. This activity is significant as it may indicate a brute-force attack or misconfiguration, both of which require immediate attention. If confirmed malicious, this behavior could lead to account compromise, unauthorized access, and potential lateral movement within the network.
This analytic detects endpoints that generate a high number of account lockouts within a short timeframe. It analyzes Windows security event logs, specifically the `Change` datamodel's `Account_Management` node, to count lockout events. This activity can indicate a brute-force attack or a misconfigured system causing repeated authentication failures. If malicious, it could lead to denial of service through account lockouts or signal an ongoing attempt to compromise user credentials.
The analytic detects a suspicious computer account name change in Active Directory. It leverages Event ID 4781, which logs account name changes, to identify instances where a computer account name is changed to one that does not end with a '$'. This behavior is significant as it may indicate an attempt to exploit CVE-2021-42278 and CVE-2021-42287, which can lead to domain controller impersonation and privilege escalation. If confirmed malicious, this activity could allow an attacker to gain elevated privileges and potentially control the domain.
This analytic detects suspicious Kerberos Ticket Granting Ticket (TGT) requests that may indicate exploitation of CVE-2021-42278 and CVE-2021-42287. It identifies sequences where a computer account is renamed (Event ID 4781) and immediately followed by a TGT request (Event ID 4768) for that same account. This behavior is significant as it could represent an attempt to escalate privileges by impersonating a Domain Controller, potentially leading to elevated access and control over the domain environment.
Page 5 of 5