Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
267 detections
Filters
Last updated
All Time
Detection languages
87
81
42
19
18
Contributors
43
41
40
36
29
Categories
130
127
54
44
40
Platforms
253
6
5
5
3
Products / Services
91
72
50
40
27
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
4
1
IDS Classtypes
2
IDS Protocols
2
2
This rule detects the creation of specific files that are commonly generated by the BloodHound collection tool, SharpHound. These files, such as 'BloodHound.zip', '_computers.json', '_domains.json', '_groups.json', and others, contain collected Active Directory information. The presence of these files on a system indicates that BloodHound or SharpHound has been used for reconnaissance, which is often a precursor to further malicious activity within an Active Directory environment.
Detects reconnaissance activity involving attempts to enumerate domain administrator accounts and domain groups. Specifically, it looks for Event ID 4661 (An operation was performed on an object) with an AccessMask of '0x2d' (which indicates a read access attempt) on SAM_USER or SAM_GROUP objects whose ObjectName corresponds to well-known SIDs for the built-in Administrator account (-500) or Domain Admins group (-512) within a domain (S-1-5-21- prefix). This activity is often associated with adversaries using commands like 'net user administrator /domain' or 'net group domain admins /domain' to discover privileged accounts.
Detects reconnaissance activities targeting privileged Active Directory users or groups by monitoring Windows Security Event ID 4661. The rule specifically looks for access attempts to objects identified as privileged users or groups based on their Security Identifier (SID) suffixes or names containing 'admin'. It filters out activity from machine accounts to reduce false positives.
Detects the execution of "csvde.exe" with the '-f' flag, indicating an attempt to export the Active Directory structure. This tool is often used by adversaries for discovery and collection of domain account information.
Detects the execution of AdFind with command-line flags commonly associated with reconnaissance activities during attacks. AdFind is a legitimate tool that can be abused by adversaries to gather extensive information about Active Directory environments, including domain trusts, user accounts, computer objects, and group policies.
Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE. This rule identifies attempts to enumerate local or domain groups and accounts, specifically looking for commands that list members of sensitive groups like 'domain admins' or 'enterprise admins', or general account information. It filters out commands that are used to add users or groups to reduce false positives. The rule also includes checks for common administrative group names in multiple languages.
Detects the use of PowerShell's 'Import-Module' cmdlet to load the 'Microsoft.ActiveDirectory.Management.dll'. This DLL is part of the Active Directory module and is frequently used by attackers for Active Directory enumeration, especially in environments where RSAT (Remote Server Administration Tools) might not be installed or administrative privileges are not initially present.
Detects the usage of the 'Get-AdComputer' PowerShell cmdlet to enumerate computer objects or their properties within Active Directory. This activity is often performed during the discovery phase of an attack to map out the network environment.
Detects read access to a domain user from a non-machine account
Detects activity as "net user administrator /domain" and "net group domain admins /domain"
Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.
Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs
Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.
Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE
Check if the user that executed the commands is suspicious (e.g. service accounts, LOCAL_SYSTEM)
Check if the user that executed the commands is suspicious (e.g. service accounts, LOCAL_SYSTEM)
Detects command line parameters used by Bloodhound and Sharphound hack tools
Page 13 of 13