Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40 detections
Filters
Last updated
All Time
Detection languages
18
10
7
3
2
Contributors
10
10
6
3
2
Categories
17
11
11
7
5
Platforms
28
4
3
3
1
Products / Services
12
7
6
5
4
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
2
1
IDS Protocols
2
1
The following analytic detects the execution of `powershell.exe` running the `Get-ADDefaultDomainPasswordPolicy` cmdlet, which is used to retrieve the password policy in a Windows domain.
This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions.
Monitoring this activity is crucial as it can indicate attempts by adversaries to gather information about domain policies for situational awareness and Active Directory discovery.
If confirmed malicious, this activity could lead to further reconnaissance and potential exploitation of domain security settings.
This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions.
Monitoring this activity is crucial as it can indicate attempts by adversaries to gather information about domain policies for situational awareness and Active Directory discovery.
If confirmed malicious, this activity could lead to further reconnaissance and potential exploitation of domain security settings.
The following analytic detects the execution of `powershell.exe` running the `Get-DomainPolicy` cmdlet, which is used to retrieve password policies in a Windows domain. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to gather domain policy information, which is crucial for planning further attacks. If confirmed malicious, this could lead to unauthorized access to sensitive domain configurations, aiding in privilege escalation and lateral movement within the network.
This rule detects attempts to query the domain password policy over SMB by looking for the 'NetUserModalsGet' content within TCP traffic on port 445. This activity is often associated with reconnaissance or discovery phases by attackers to understand password complexity requirements.
This rule detects attempts to enumerate password policy information, specifically the 'pwdHistoryLength' attribute, from a domain controller via an LDAP query. It looks for TCP traffic on port 389 (LDAP) where the client sends a query containing both '(objectClass=domain)' and 'pwdHistoryLength' in a case-insensitive manner.
This rule detects attempts to discover password policy information by executing the 'net accounts' command via a web shell. The rule specifically looks for HTTP requests where the URI content contains 'net accounts' in a case-insensitive manner, indicating a potential web-based command execution to gather system information related to password policies.
This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.
Detects scenarios where an attacker attempts to enumerate the domain password policy with native commands or tools like CME (--pass-pol).
Detects scenarios where an attacker attempts to enumerate the password policy via commandline.
This hunting rule searches for incoming ADWS connections on Domain Controllers from IP Addresses that cannot be linked to Microsoft Defender for Endpoint (MDE) onboarded devices. It aims to detect enumeration activities using ADWS from unmanaged or unknown devices, which might bypass typical monitoring tools.
This query detects PowerShell and command-line activities associated with Active Directory reconnaissance, focusing on:
- Account & Group Discovery (T1087, T1069)
-- Local/Domain user/group enumeration (Get-ADUser, net user, Get-LocalGroupMember).
- Password Policy Discovery (T1201)
-- Checks domain password rules (Get-ADDefaultDomainPasswordPolicy, net accounts /domain).
- Domain Trust & Network Mapping (T1482, T1135, T1016)
-- Trust relationships (nltest /domain_trusts), shares (net share), and DNS/IP config (ipconfig).
- Lateral Movement Prep (T1021.002, T1213.002)
-- SMB share access (net use), AD object/ACL dumping (Get-ADObject).
Why It Matters:
Adversaries use these commands to map the AD environment before attacks like:
- Brute-forcing (using password policy info from T1201).
- Privilege escalation (via group membership data from T1069).
- Lateral movement (via share/trust discovery from T1135/T1482).
- Account & Group Discovery (T1087, T1069)
-- Local/Domain user/group enumeration (Get-ADUser, net user, Get-LocalGroupMember).
- Password Policy Discovery (T1201)
-- Checks domain password rules (Get-ADDefaultDomainPasswordPolicy, net accounts /domain).
- Domain Trust & Network Mapping (T1482, T1135, T1016)
-- Trust relationships (nltest /domain_trusts), shares (net share), and DNS/IP config (ipconfig).
- Lateral Movement Prep (T1021.002, T1213.002)
-- SMB share access (net use), AD object/ACL dumping (Get-ADObject).
Why It Matters:
Adversaries use these commands to map the AD environment before attacks like:
- Brute-forcing (using password policy info from T1201).
- Privilege escalation (via group membership data from T1069).
- Lateral movement (via share/trust discovery from T1135/T1482).
Detects command-line and PowerShell attempts to discover Windows domain/local password policies, which adversaries use to plan brute-force attacks or credential exploitation.
Each command is a reconnaissance step to answer:
"How many guesses can I make before lockout?"
"What password complexity rules exist?"
"Which domains have weaker policies?"
This aligns with MITRE’s definition of T1201.
Each command is a reconnaissance step to answer:
"How many guesses can I make before lockout?"
"What password complexity rules exist?"
"Which domains have weaker policies?"
This aligns with MITRE’s definition of T1201.
KQL Query
KQL Query from file: glibc critical vulnerability (CVSS 9.8)
Detects when the password policy is enumerated.
This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.
This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.
Net.EXE Execution
Sigma
Detects execution of "Net.EXE".
Detetcts PowerShell activity in which Get-Addefaultdomainpasswordpolicy is used to get the default password policy for an Active Directory domain.
Net.EXE Execution
Sigma
Detects execution of "Net.EXE".
Attackers can use Adfind which is administrative tool to gather information about Domain controllers, ADFS Servers. They may also rename executables with other benign tools on the system.
Below query will look for adfind usage in commandline arguments irrespective of executable name in short span of time. You can limit query this to your DC and ADFS servers.
Below references talk about suspicious use of adfind by adversaries.
- https://thedfirreport.com/2020/05/08/adfind-recon/
- https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
- https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/
Below query will look for adfind usage in commandline arguments irrespective of executable name in short span of time. You can limit query this to your DC and ADFS servers.
Below references talk about suspicious use of adfind by adversaries.
- https://thedfirreport.com/2020/05/08/adfind-recon/
- https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
- https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/
This query helps in reviewing top policies for user overrides (Allow/Block)
Page 1 of 2