Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
215 detections
Filters
Last updated
All Time
Detection languages
113
32
28
17
12
Contributors
91
25
13
11
10
Categories
98
88
73
55
48
Platforms
163
83
54
18
5
Products / Services
112
95
59
34
17
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
7
3
2
IDS Classtypes
1
IDS Protocols
1
The following analytic identifies discrepancies between the IP address of an authentication event and the IP address of the verification response event, focusing on differences in the originating countries. It leverages JSON logs from PingID, comparing the 'auth_Country' and 'verify_Country' fields. This activity is significant as it may indicate suspicious sign-in behavior, such as account compromise or unauthorized access attempts. If confirmed malicious, this could allow attackers to bypass authentication mechanisms, potentially leading to unauthorized access to sensitive systems and data.
The following analytic identifies the provisioning of a new MFA device shortly after a password reset. It detects this activity by correlating Windows Event Log events for password changes (EventID 4723, 4724) with PingID logs indicating device pairing. This behavior is significant as it may indicate a social engineering attack where a threat actor impersonates a valid user to reset credentials and add a new MFA device. If confirmed malicious, this activity could allow an attacker to gain persistent access to the compromised account, bypassing traditional security measures.
Detects the execution of AADInternals PowerShell cmdlets. AADInternals is a tool used for administering Azure AD and Office 365, which can be abused by threat actors for various attacks including reconnaissance, credential access, and impact within Azure AD or Office 365 environments. The rule specifically looks for the unique "-AADInt" string prefix in cmdlet names.
Detects the creation of a specific file path commonly used in Proof-of-Concept (PoC) exploits for the Print Spooler vulnerability CVE-2021-1675, also known as PrintNightmare. This file path is typically created when an attacker successfully exploits the vulnerability to achieve remote code execution or privilege escalation.
Detects the creation or modification of registry keys related to printer drivers that contain specific strings associated with Mimikatz or the PrinterNightmare vulnerability (CVE-2021-1675, CVE-2021-34527). The rule looks for 'QMS 810' or 'mimikatz' in printer driver paths, or a combination of 'legitprinter' and printer environment paths, or specific strings like 'Gentil Kiwi', 'mimikatz printer', or 'Kiwi Legit Printer' in registry objects related to printing.
Page 11 of 11