Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
134 detections
Filters
Last updated
All Time
Detection languages
60
33
10
10
9
Contributors
42
25
8
7
6
Categories
84
54
30
20
19
Platforms
116
11
5
4
1
Products / Services
48
38
33
9
7
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
CVEs
1
1
1
IDS Classtypes
2
1
IDS Protocols
1
1
1
This will show Active Directory Security Token Service (STS) refresh token modifications by Service Principals and Applications other than DirectorySync. Refresh tokens are used to validate identification and obtain access tokens. This event is most often generated when legitimate administrators troubleshoot frequent Entra ID user sign-ins but may also be generated as a result of malicious token extensions. Confirm that the activity is related to an administrator legitimately modifying STS refresh tokens and check the new token validation time period for high values.
Query insprired by Azure Sentinel detection https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/StsRefreshTokenModification.yaml
Query insprired by Azure Sentinel detection https://github.com/Azure/Azure-Sentinel/blob/master/Detections/AuditLogs/StsRefreshTokenModification.yaml
'This query identifies whether an Active Directory user object was assigned a service principal name which could indicate that an adversary is preparing for performing Kerberoasting.
This query checks for event id 5136, that the Object Class field is "user" and the LDAP Display Name is "servicePrincipalName".
Ref: https://thevivi.net/assets/docs/2019/theVIVI-AD-Security-Workshop_AfricaHackon2019.pdf'
This query checks for event id 5136, that the Object Class field is "user" and the LDAP Display Name is "servicePrincipalName".
Ref: https://thevivi.net/assets/docs/2019/theVIVI-AD-Security-Workshop_AfricaHackon2019.pdf'
'Under specific circumstances, executing KQL queries can exfiltrate information like access tokens, regarding external data functions like adx().
This query tries to list executed KQL queries that used the adx() function and where an access token might have been exposed to.
Ref: https://docs.microsoft.com/azure/azure-monitor/logs/azure-monitor-data-explorer-proxy
Ref: https://securecloud.blog/2022/04/27/azure-monitor-malicious-kql-query/'
This query tries to list executed KQL queries that used the adx() function and where an access token might have been exposed to.
Ref: https://docs.microsoft.com/azure/azure-monitor/logs/azure-monitor-data-explorer-proxy
Ref: https://securecloud.blog/2022/04/27/azure-monitor-malicious-kql-query/'
'This query identifies Active Directory computer objects modifications that allow an adversary to abuse the Resource-based constrained delegation.
This query checks for event id 5136 that the Object Class field is "computer" and the LDAP Display Name is "msDS-AllowedToActOnBehalfOfOtherIdentity" which is an indicator of Resource-based constrained delegation.
Ref: https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html'
This query checks for event id 5136 that the Object Class field is "computer" and the LDAP Display Name is "msDS-AllowedToActOnBehalfOfOtherIdentity" which is an indicator of Resource-based constrained delegation.
Ref: https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html'
This analytic detects any system integrity level process spawned by a non-system account. It leverages Sysmon EventID 1, focusing on process integrity and parent user data. This behavior is significant as it often indicates successful privilege escalation to SYSTEM from a user-controlled process or service. If confirmed malicious, this activity could allow an attacker to gain full control over the system, execute arbitrary code, and potentially compromise the entire environment.
Detects the execution of the 'Impersonate' tool, which is designed to manipulate Windows tokens. This tool can be used to escalate privileges by impersonating other user tokens, either remotely (e.g., via PsExec/WmiExec) or interactively. Detection is based on specific command-line arguments or known hashes of the tool.
This rule detects the presence of keywords commonly associated with well-known PowerShell exploitation frameworks such as Mimikatz and Metasploit within PowerShell script blocks. The keywords indicate attempts to perform privileged operations like manipulating access tokens, reading process memory, or other actions typically involved in credential dumping and privilege escalation. Detection relies on PowerShell Script Block Logging being enabled to capture the script content.
This rule detects the DarkSide ransomware by identifying specific byte patterns (YARA signatures) associated with its functionality. The rule looks for combinations of code that suggest file enumeration, drive enumeration, privilege escalation, and network share enumeration, which are common behaviors of DarkSide ransomware. Specifically, it checks for two main sets of conditions: one involving finding files, enumerating drives, and escalating privileges, and another involving finding files and enumerating network shares. The rule also verifies that the file is a Windows executable (MZ header).
Page 7 of 7