Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
17 detections
Filters
Last updated
All Time
Detection languages
12
4
1
Contributors
6
6
2
1
1
Categories
11
5
3
3
2
Platforms
17
1
Products / Services
6
3
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects potentially suspicious explicit credential logon events where the user
is trying to logon with explicit credentials (username and password) that are
different from the current user context. It might indicate an attacker attempting
to escalate privileges after obtaining credentials for a different user account.
is trying to logon with explicit credentials (username and password) that are
different from the current user context. It might indicate an attacker attempting
to escalate privileges after obtaining credentials for a different user account.
Detects LogonUser API used with token impersonation for privilege escalation
Detects rapid failed local Windows account logon attempts consistent with Pony malware's built-in dictionary brute-force routine, which enumerates local accounts via NetUserEnum and cycles passwords via LogonUserA (advapi32). A high volume of type-2 interactive logon failures against multiple local accounts in a short window is the key behavioral signal.
Detects the Pony malware credential harvesting sequence where a non-system process performs repeated interactive logon attempts (LogonUserA dictionary brute force via NetUserEnum) against local accounts and achieves at least one successful logon, after which LoadUserProfileA is used to impersonate the compromised account and harvest profile-scoped credentials.
This rule detects HTTP traffic containing the strings "LogonUserA" and "ImpersonateLoggedOnUser" (case-insensitive) in the file data. This combination of strings suggests an attempt to create a token for impersonation, which is a technique used for privilege escalation, specifically related to the MITRE ATT&CK technique T1134.003 (Token Impersonation/Theft: Impersonation). The rule is designed to identify shellcode or malicious code attempting to leverage these Windows API functions for privilege escalation.
Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively
Detects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata.
SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.
SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.
Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively
Detects potential token theft, impersonation, or privilege escalation activity in Windows environments by monitoring ProcessPrimaryTokenModified events. This query highlights suspicious changes in SIDs, token sources, integrity levels, or privilege flags, including attempts to impersonate SYSTEM or add high-risk privileges (SeDebugPrivilege, SeImpersonatePrivilege). Such behavior is strongly associated with lateral movement and privilege escalation techniques used by APTs, ransomware operators, and red team tooling like Mimikatz and Cobalt Strike.
Detects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata.
SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.
SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.
Detects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata.
SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.
SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.
Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively
Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively
Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively
Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively
Detects the execution of the 'Impersonate' tool, which is designed to manipulate Windows tokens. This tool can be used to escalate privileges by impersonating other user tokens, either remotely (e.g., via PsExec/WmiExec) or interactively. Detection is based on specific command-line arguments or known hashes of the tool.
Detects the execution of the SharpImpersonation tool, which is used for manipulating tokens on Windows systems. This can occur remotely via tools like PsExec/WmiExec or interactively. The rule specifically looks for the executable name or command-line arguments indicating token manipulation techniques such as 'CreateProcessAsUserW' or 'ImpersonateLoggedOnUser', often combined with 'user:' and 'binary:' or 'shellcode:' parameters.