Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
130 detections
Filters
Last updated
All Time
Detection languages
67
20
18
8
7
Contributors
32
28
19
15
8
Categories
80
58
22
12
9
Platforms
127
3
Products / Services
50
41
17
13
12
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
5
1
IDS Classtypes
3
IDS Protocols
3
2
Detects the correlation of two or more distinct discovery tools or artifacts (such as SharpShares, NetScan, NetExec, ShareFinder, and specific nltest.exe domain trust commands) executed on the same device within a one-hour window.
The following analytic detects the usage of the SharpHound binary by identifying its original filename, `SharpHound.exe`, and the process name. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process metadata and command-line executions. SharpHound is a tool used for Active Directory enumeration, often by attackers during the reconnaissance phase. If confirmed malicious, this activity could allow an attacker to map out the network, identify high-value targets, and plan further attacks, potentially leading to privilege escalation and lateral movement within the environment.
The following analytic detects the execution of SharpHound command-line arguments, specifically `-collectionMethod` and `invoke-bloodhound`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as SharpHound is commonly used for Active Directory enumeration, which can be a precursor to lateral movement or privilege escalation. If confirmed malicious, this activity could allow an attacker to map out the network, identify high-value targets, and plan further attacks, potentially compromising sensitive information and critical systems.
The following analytic detects the creation of files typically associated with SharpHound, a reconnaissance tool used for gathering domain and trust data. It leverages file modification events from the Endpoint.Filesystem data model, focusing on default file naming patterns like `*_BloodHound.zip` and various JSON files. This activity is significant as it indicates potential domain enumeration, which is a precursor to more targeted attacks. If confirmed malicious, an attacker could gain detailed insights into the domain structure, facilitating lateral movement and privilege escalation.
The following analytic detects the execution of "dsquery.exe" with arguments targeting `TrustedDomain` queries directly from the command line. This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on process names and command-line arguments. This activity is significant as it often indicates domain trust discovery, a common step in lateral movement or privilege escalation by adversaries. If confirmed malicious, this could allow attackers to map domain trusts, potentially leading to further exploitation and unauthorized access to trusted domains.
The following analytic identifies the execution of the Get-DomainTrust command from PowerView using PowerShell, which is used to gather domain trust information. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. This activity is significant as it indicates potential reconnaissance efforts by an adversary to understand domain trust relationships, which can inform lateral movement strategies. If confirmed malicious, this could allow attackers to map out the network, identify potential targets, and plan further attacks, potentially compromising additional systems within the domain.
The following analytic detects the execution of the Get-ForestTrust command via PowerShell, commonly used by adversaries to gather domain trust information. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. Identifying this activity is crucial as it indicates potential reconnaissance efforts to map out domain trusts, which can inform further attacks. If confirmed malicious, this activity could allow attackers to understand domain relationships, aiding in lateral movement and privilege escalation within the network.
The following analytic identifies the execution of `nltest.exe` with command-line arguments `/domain_trusts` or `/all_trusts` to query Domain Trust information. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant as it indicates potential reconnaissance efforts by adversaries to understand domain trust relationships, which can inform their lateral movement strategies. If confirmed malicious, this activity could enable attackers to map out trusted domains, facilitating further compromise and pivoting within the network.
Detects the execution of common enumeration tools and commands often associated with ransomware-precursor behavior. This includes the use of AdFind, dsquery, net.exe, and nltest for domain account, group, and trust discovery, as well as the execution of BloodHound/SharpHound collection activities.
Detects the execution of known Active Directory reconnaissance tools, specifically AdFind and SharpHound/BloodHound. These tools are commonly used by adversaries to enumerate domain objects, users, computers, groups, and trusts, which are essential precursors to further lateral movement and privilege escalation within a domain environment.
Detects the execution of reconnaissance commands designed to enumerate Active Directory domain trust relationships. Attackers, including those associated with ransomware operations like INC Ransom, use these tools to map organizational structures and identify pathways for lateral movement and cross-domain propagation.
Detects a single host or account generating a high volume of LDAP queries (typical of reconnaissance tools like BloodHound/SharpHound) within a 10-minute time window. The rule specifically looks for more than 500 LDAP queries targeted at a limited number of Domain Controllers.
Detects the execution of reconnaissance commands designed to enumerate Active Directory domain trust relationships. Attackers, including those associated with ransomware operations like INC Ransom, use these tools to map organizational structures and identify pathways for lateral movement and cross-domain propagation.
Detects processes attempting to enumerate Active Directory objects (users, groups, trusts) while simultaneously establishing a network connection to Active Directory Web Services (ADWS) on port 9389. This behavior is characteristic of tools like SharpADWS, which performs AD enumeration via the ADWS protocol rather than traditional LDAP, potentially bypassing legacy detection mechanisms.
Detects ClickFix-style browser or explorer spawned command execution using clipboard-paste patterns, or subsequent ransomware-related discovery and inhibit-system-recovery commands such as net.exe, nltest.exe, and vssadmin.exe used after initial access.
Detects pythonw.exe executing from non-standard paths (ProgramData, AppData, or Temp) while loading netapi32.dll or ntdsapi.dll, consistent with the TWINLOOT implant's recon module performing NetAPI-based enumeration of domain controllers, admins, and domain trusts via DsEnumerateDomainTrusts and related calls, as observed being tasked by operators through the SharePoint dead-drop C2 channel.
This rule detects hosts exhibiting behavior consistent with an active ransomware or destructive attack in progress, by correlating five distinct attack-chain stages within a rolling 24-hour window: environment/AD enumeration, network share discovery, lateral movement via RDP, credential dumping, and backup/recovery destruction.
Detects Abyssos RAT modules (DCFINDER, VULNSCAN, ELEVATE_SYS_TOKEN, RDPWRAP) by requiring a shared XOR/AES-CBC key alongside a temp-folder write using a module-specific short prefix (dcf, vul, plg, rdp) that is followed by execution via an anomalous export function name (abyss or the module-specific Get*Text/Json exports)
Detects in-process LDAP enumeration of Active Directory through the .NET System.DirectoryServices classes, the [adsisearcher] type accelerator and DirectorySearcher, captured from PowerShell ScriptBlock logging in action_evtlog_message. Severity is assigned from the LDAP filter and requested attributes. CRITICAL covers queries after credential-bearing attributes (LAPS, gMSA, sIDHistory, GPP/SYSVOL paths) or DCSync replication rights. HIGH covers known attack-technique targeting: Tier Zero enumeration via adminCount, SPN enumeration for Kerberoasting, delegation attributes, and the UAC bitmask filters used for AS-REP roasting and unconstrained delegation. MEDIUM covers broad estate enumeration across groups, computers, GPOs, and OUs. Command-line context (suspicious parent process, encoded or hidden execution) is surfaced as separate fields for triage rather than folded into the score.
Detects privileged Active Directory enumeration seen on the wire by Corelight, filtered to source hosts that don't appear in the Cortex endpoint inventory. It reads ldap_search records from corelight_zeek_raw, tiers them by the LDAP filter (CRITICAL for credential-attribute and DCSync hunting, HIGH for Tier Zero, Kerberoast, delegation, and UAC-bitmask targeting, MEDIUM for broad group, computer, and GPO enumeration), then joins the source address against endpoints and keeps only the queries whose id_orig_h has no matching managed agent
Detects privileged Active Directory enumeration seen on the wire by Corelight, filtered to source hosts that don't appear in the Cortex endpoint inventory. It reads ldap_search records from corelight_zeek_raw, tiers them by the LDAP filter (CRITICAL for credential-attribute and DCSync hunting, HIGH for Tier Zero, Kerberoast, delegation, and UAC-bitmask targeting, MEDIUM for broad group, computer, and GPO enumeration), then joins the source address against endpoints and keeps only the queries whose id_orig_h has no matching managed agent
Page 1 of 7