Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40 detections
Filters
Last updated
All Time
Detection languages
18
10
7
3
2
Contributors
10
10
6
3
2
Categories
17
11
11
7
5
Platforms
28
4
3
3
1
Products / Services
12
7
6
5
4
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
1
IDS Protocols
2
1
The following analytic detects successful API calls to view, update, or delete the password policy in an AWS organization. It leverages AWS CloudTrail logs to identify events such as "UpdateAccountPasswordPolicy," "GetAccountPasswordPolicy," and "DeleteAccountPasswordPolicy." This activity is significant because it is uncommon for regular users to perform these actions, and such changes can indicate an adversary attempting to understand or weaken password defenses. If confirmed malicious, this could lead to compromised accounts and increased attack surface, potentially allowing unauthorized access and control over AWS resources.
The following analytic identifies the execution of `net.exe` with command line arguments aimed at obtaining the computer or domain password policy. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to gather information about Active Directory password policies. If confirmed malicious, this behavior could allow attackers to understand password complexity requirements, aiding in brute-force or password-guessing attacks, ultimately compromising user accounts and gaining unauthorized access to the network.
This analytic detects the execution of the `Get-DomainPolicy` cmdlet using PowerShell Script Block Logging (EventCode=4104). It leverages logs capturing script block text to identify attempts to obtain the password policy in a Windows domain. This activity is significant as it indicates potential reconnaissance efforts by adversaries or Red Teams to gather domain policy information, which is crucial for planning further attacks. If confirmed malicious, this behavior could lead to detailed knowledge of domain security settings, aiding in privilege escalation or lateral movement within the network.
The analytic detects the execution of the `Get-ADUserResultantPasswordPolicy` PowerShell cmdlet, which is used to obtain the password policy in a Windows domain. This activity is identified by leveraging PowerShell Script Block Logging (EventCode=4104). Monitoring this behavior is significant as it may indicate an attempt to enumerate domain policies, a common tactic used by adversaries for situational awareness and Active Directory discovery. If confirmed malicious, this activity could allow attackers to understand password policies, aiding in further attacks such as password guessing or policy exploitation.
The analytic detects the execution of `powershell.exe` running the `Get-ADDefaultDomainPasswordPolicy` cmdlet. This cmdlet is used to retrieve the password policy in a Windows domain. Monitoring this activity is crucial as it can indicate attempts by adversaries to gather information about domain policies for situational awareness and Active Directory discovery. If confirmed malicious, this activity could lead to further reconnaissance and potential exploitation of domain security settings.
The analytic detects the execution of the `Get-ADDefaultDomainPasswordPolicy` PowerShell cmdlet, which is used to retrieve the password policy in a Windows domain. This detection leverages PowerShell Script Block Logging (EventCode=4104) to identify the specific command execution. Monitoring this activity is significant as it can indicate an attempt to gather domain policy information, which is often a precursor to further malicious actions. If confirmed malicious, this activity could allow an attacker to understand password policies, aiding in password attacks or further domain enumeration.
The analytic detects the execution of `powershell.exe` running the `Get-ADUserResultantPasswordPolicy` cmdlet, which is used to obtain the password policy in a Windows domain. This activity indicates potential enumeration of domain policies, a common tactic for situational awareness and Active Directory discovery by adversaries. If confirmed malicious, this could allow attackers to understand password policies, aiding in further attacks such as password spraying or brute force attempts.
The following analytic detects the execution of `powershell.exe` running the `Get-DomainPolicy` cmdlet, which is used to retrieve password policies in a Windows domain. This activity is significant as it indicates potential reconnaissance efforts by adversaries to gather domain policy information, which is crucial for planning further attacks. If confirmed malicious, this could lead to unauthorized access to sensitive domain configurations, aiding in privilege escalation and lateral movement within the network.
Detects when an existing password policy is updated or deleted in an AWS account. This could indicate an adversary attempting to weaken password requirements to facilitate brute-force attacks or to remove obstacles for credential reuse.
Detects when an existing password policy is updated or deleted in an AWS account.
Detects attempts to discover password policy information on Linux systems by monitoring access to key configuration files and the execution of 'chage' and 'passwd' commands with specific arguments.
Detects password policy discovery commands
Detects the execution of 'net.exe' or 'net1.exe' with command-line arguments commonly used for discovery activities related to accounts, groups, shares, and services. This rule aims to identify potential reconnaissance or privilege escalation attempts.
Detects when the password policy is enumerated on a Windows system. This activity is logged as Event ID 4661, specifically looking for access rights related to 'ReadPasswordParameters' on objects within the 'Security Account Manager'. This can indicate an adversary attempting to gather information about password requirements to aid in further attacks like password guessing or brute-forcing.
Detects PowerShell activity where the 'Get-AdDefaultDomainPasswordPolicy' cmdlet is used to retrieve the default password policy for an Active Directory domain. This action can be performed by adversaries to understand password complexity requirements and account lockout policies, which can aid in planning brute-force or password-guessing attacks.
This rule detects common flag combinations used by CrackMapExec, a post-exploitation tool, to identify its execution even if the binary name has been changed. It looks for specific command-line arguments related to local authentication, hash-based authentication, and module usage for SMB and MSSQL protocols.
Cisco Discovery
Sigma
Find information about network devices that is not stored in config files
Detects when the password policy is enumerated.
Detetcts PowerShell activity in which Get-Addefaultdomainpasswordpolicy is used to get the default password policy for an Active Directory domain.
Page 2 of 2