Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
26 detections
Filters
Last updated
All Time
Detection languages
11
10
3
2
Contributors
7
5
4
3
2
Categories
9
8
4
2
2
Platforms
23
4
Products / Services
18
14
2
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
This detection identifies an Active Directory access-control list (ACL) modification event, which applies the minimum required extended rights to perform the DCShadow attack.
This rule detects indicators of the DCShadow attack technique by monitoring for the creation of nTDSDSA objects (which define domain controllers) or the addition of suspicious Service Principal Names (SPNs) often used in DCShadow simulations (GC/ or E3514235-4B06) to computer accounts. These indicators suggest an attacker is attempting to register a rogue Domain Controller to manipulate Active Directory data.
This rule detects indicators of the DCShadow attack technique by monitoring for the creation of nTDSDSA objects (which define domain controllers) or the addition of suspicious Service Principal Names (SPNs) often used in DCShadow simulations (GC/ or E3514235-4B06) to computer accounts. These indicators suggest an attacker is attempting to register a rogue Domain Controller to manipulate Active Directory data.
This rule detects a replication request to a Domain Controller (DC) containing the string "DsGetNCChanges" over TCP port 389 (LDAP). This specific string is associated with Active Directory replication. The rule is designed to identify potential rogue Domain Controllers attempting to replicate with legitimate DCs, which could indicate an attacker trying to establish a malicious DC for credential harvesting or other attacks. A threshold of 3 occurrences within 60 seconds from the same source IP is set to reduce false positives.
This rule detects unauthorized Kerberos service ticket requests directed at a Domain Controller (DC). It specifically looks for TCP traffic to port 88 (Kerberos) on the home network, with a content match for the byte sequence '|6b|' at the beginning of the payload. A threshold of 50 requests within 10 seconds from the same source IP triggers the alert, indicating a potential brute-force or enumeration attempt against Kerberos services.
Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new SPN.
Detects DCShadow via create new SPN
_ldap._tcp.dc._msdcs.ad.domain.com is a DNS query used by AD clients to locate Domain Controllers that can provide LDAP services for the ad.domain.com domain, ensuring users and computers can authenticate, query directory data, and function inside the AD forest.
This SPL query flags IP addresses returned by DNS for the AD DC-locator SRV query (_ldap._tcp.dc._msdcs.ad.domain.com.) that are not known/approved Domain Controllers in your inventory, and that show up frequently (more than 10 hits in the selected time range).
This can be for the use case where an attacker has compromised or poisoned a DNS server / resolver and is advertising their IP(s) as Domain Controllers (SRV/A glue in _msdcs) so clients attempt LDAP/Kerberos against attacker-controlled hosts.
This SPL query flags IP addresses returned by DNS for the AD DC-locator SRV query (_ldap._tcp.dc._msdcs.ad.domain.com.) that are not known/approved Domain Controllers in your inventory, and that show up frequently (more than 10 hits in the selected time range).
This can be for the use case where an attacker has compromised or poisoned a DNS server / resolver and is advertising their IP(s) as Domain Controllers (SRV/A glue in _msdcs) so clients attempt LDAP/Kerberos against attacker-controlled hosts.
Detects scenarios where an attacker accessed attributes related to DCshadow attack in order to create a fake domain controller.
Detects scenarios where an attacker update the Service Principal Name (SPN) of a computer account in order to perform "Kerberos redirection" and escalate privileges.
Detects scenarios where an attacker would dump user passwords using the DCshadow attack.
Detects scenarios where an attacker updates the Service Principal Name (SPN) of a fake domain controller account in order to perform DCshadow attack.
Detects DCShadow via create new SPN
Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new SPN.
Attackers can use Adfind which is administrative tool to gather information about Domain controllers, ADFS Servers. They may also rename executables with other benign tools on the system.
Below query will look for adfind usage in commandline arguments irrespective of executable name in short span of time. You can limit query this to your DC and ADFS servers.
Below references talk about suspicious use of adfind by adversaries.
- https://thedfirreport.com/2020/05/08/adfind-recon/
- https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
- https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/
Below query will look for adfind usage in commandline arguments irrespective of executable name in short span of time. You can limit query this to your DC and ADFS servers.
Below references talk about suspicious use of adfind by adversaries.
- https://thedfirreport.com/2020/05/08/adfind-recon/
- https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
- https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/
'This detection will go over the heartbeats received from the agents of Domain Controllers over the last hour, and will create alerts if the last heartbeats were received an hour ago.'
LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operations in 2021. Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity.
This rule detects remote RPC calls to the Microsoft Directory Replication Service Remote Protocol (MS-DRSR) originating from hosts that are not designated as Domain Controllers. Such activity is highly indicative of potential DCSync or DCShadow attacks, where an attacker attempts to replicate Active Directory data, including sensitive credentials, by impersonating a Domain Controller. The rule specifically looks for RPC Firewall logs (EventLog: RPCFW, EventID: 3) where the InterfaceUuid matches 'e3514235-4b06-11d1-ab04-00c04fc2dcd2' (MS-DRSR) and the operation number (OpNum) is not 0, 1, or 12, as these are considered 'dangerous' opcodes when initiated from non-DC hosts.
This rule detects potential DCShadow attacks by looking for the creation of new Service Principal Names (SPNs) that contain 'GC/' in either Event ID 4742 (A computer account was changed) or Event ID 5136 (A directory service object was modified). DCShadow is a technique used by adversaries to register a rogue Domain Controller and manipulate Active Directory data.
This analytic identifies unexpected Active Directory replication traffic originating from non-domain controller sources. It specifically looks for network traffic associated with AD replication protocols (ms-dc-replication, drsr, ad drs). Such traffic should typically only occur between legitimate domain controllers. Detection of this activity from other sources may indicate malicious activities like DCSync or DCShadow, which are commonly used for credential dumping and could lead to unauthorized access and potential domain-wide compromise.
This detection identifies an Active Directory access-control list (ACL) modification event, which applies the minimum required extended rights to perform the DCShadow attack. Specifically, it looks for modifications to the domainDNS object where specific GUIDs related to 'Add/Remove Replica In Domain', 'Manage Replication Topology', and 'Replication Synchronization' are added to the ACL. These permissions are necessary for an attacker to register a rogue domain controller and perform a DCShadow attack.
Page 1 of 2