Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11 detections
Filters
Last updated
All Time
Detection languages
5
4
2
Contributors
2
2
2
2
2
Categories
8
3
3
2
2
Platforms
5
4
2
1
1
Products / Services
3
2
2
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
1
1
Detects a sequence of failed authentication attempts potentially indicative of an offline JWT secret brute-force attack (using tools like jwt_tool), followed by a successful authentication from the same source. This pattern suggests the adversary successfully recovered the secret, forged a valid token, and subsequently used it to gain unauthorized access.
This rule detects attempts to download files that appear to be password hash lists or wordlists, often used for offline credential cracking. It specifically looks for HTTP URIs containing keywords like 'rockyou', 'passwords', 'wordlist', or 'hashlist' followed by '.txt', and only triggers if the downloaded file size is greater than 10,000 bytes. This activity is indicative of an attacker attempting to exfiltrate or acquire data for credential access.
This rule detects network activity associated with password cracking tools like Hashcat or John the Ripper. It specifically looks for HTTP user agent strings containing "hashcat" or "john.the.ripper" in traffic flowing to a server.
KQL Query from file: Azure Cloud Security Monitoring
KQL Query from file: Exploring M365 Accounts Investigation
Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against
Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against
This query was originally published in the threat analytics report, MailSniper Exchange attack tool.
MailSniper is a tool that targets Microsoft Exchange Server. The core function is to connect to Exchange Server and search through emails. In support of this, it can perform reconnaissance, collection, exfiltration, and credential theft. MailSniper is used both by red teams running penetration tests, and by malicious actors.
Microsoft Defender Security Center may record the following alerts during and after an attack:
1. Global mail search on Exchange using MailSniper
2. Exchange mailbox or mail folder search using MailSniper
3. Enumeration of Active Directory usernames using MailSniper
4. Enumeration of the Exchange GAL using MailSniper
5. Access to Exchange inboxes using MailSniper
6. Password spraying using MailSniper
7. Enumeration of domains and user accounts using MailSniper
The following query detects activity commonly associated with attacks run with MailSniper.
Reference - https://github.com/dafthack/MailSniper
MailSniper is a tool that targets Microsoft Exchange Server. The core function is to connect to Exchange Server and search through emails. In support of this, it can perform reconnaissance, collection, exfiltration, and credential theft. MailSniper is used both by red teams running penetration tests, and by malicious actors.
Microsoft Defender Security Center may record the following alerts during and after an attack:
1. Global mail search on Exchange using MailSniper
2. Exchange mailbox or mail folder search using MailSniper
3. Enumeration of Active Directory usernames using MailSniper
4. Enumeration of the Exchange GAL using MailSniper
5. Access to Exchange inboxes using MailSniper
6. Password spraying using MailSniper
7. Enumeration of domains and user accounts using MailSniper
The following query detects activity commonly associated with attacks run with MailSniper.
Reference - https://github.com/dafthack/MailSniper
'Identifies privileged accounts that have been locked out. Verify these lockout are due to legitimate user activity and not due to threat actors attempting to access the accounts.
Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor'
Ref : https://docs.microsoft.com/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor'
This rule detects the execution of the Hashcat password cracking tool. It specifically looks for the `hashcat.exe` executable and command-line arguments indicative of cracking NTLM hashes (`-m 1000`) and using a rule file (`-r `). The rule aims to identify attempts to crack passwords, potentially using SAM file contents obtained from a Windows registry.
Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against