Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
141 detections
Filters
Last updated
All Time
Detection languages
83
36
9
6
3
Contributors
40
27
26
15
5
Categories
111
92
23
16
13
Platforms
74
46
16
16
9
Products / Services
64
64
34
29
12
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
1
IDS Protocols
1
The analytic detects the creation of a new Group Policy Object (GPO) by leveraging Windows Event IDs 5136 and 5137. These directory service change events indicate when a new GPO is created. Monitoring GPO creation is critical because adversaries can exploit GPOs to escalate privileges or deploy malware across an Active Directory network. Malicious GPO creation could allow attackers to control system configurations, deploy ransomware, or propagate malware, leading to widespread compromise and significant operational disruption.
This analytic identifies potential privilege escalation activities within an organization's Active Directory (AD) environment by correlating multiple analytics from the "Active Directory Privilege Escalation" analytic story within a specified time frame. This is significant for a SOC as it helps identify coordinated attempts to gain elevated privileges, which could indicate a serious security threat. If confirmed malicious, this activity could allow attackers to gain unauthorized access to sensitive systems and data, leading to potential data breaches and further compromise of the network.
The analytic detects modifications to default Group Policy Objects (GPOs) using Event ID 5136. It monitors changes to the `Default Domain Controllers Policy` and `Default Domain Policy`, which are critical for enforcing security settings across domain controllers and all users/computers, respectively. This activity is significant because unauthorized changes to these GPOs can indicate an adversary with privileged access attempting to deploy persistence mechanisms or execute malware across the network. If confirmed malicious, such modifications could lead to widespread compromise, allowing attackers to maintain control and execute arbitrary code on numerous hosts.
This detection identifies an Active Directory access-control list (ACL) modification event, which applies the minimum required extended rights to perform the DCShadow attack. Specifically, it looks for modifications to the domainDNS object where specific GUIDs related to 'Add/Remove Replica In Domain', 'Manage Replication Topology', and 'Replication Synchronization' are added to the ACL. These permissions are necessary for an attacker to register a rogue domain controller and perform a DCShadow attack.
This rule detects modifications to the Access Control List (ACL) of the domain root object in Active Directory. Such modifications are significant and can have a high impact on the security of the Active Directory environment. The rule specifically looks for EventCode 5136 (A directory service object was modified) where the ObjectClass is 'domainDNS'. It then parses the old and new ACL values to identify specific changes, including the type of access control entry (ACE), flags, access rights, and the security identifier (SID) of the user or group affected. The rule also attempts to resolve SIDs to user or group names for better readability. Microsoft guidance suggests that all changes at this level should be reviewed.
This analytic is looking for when an ACL is applied to an OU which denies listing the objects residing in the OU. This activity combined with modifying the owner of the OU will hide AD objects even from domain administrators.
This detection monitors the addition of specific dangerous Access Control List (ACL) entries to an Active Directory group object. These ACL modifications, such as "Full control", "All extended rights", "Modify permissions", or "Write all properties", can indicate potential privilege escalation or malicious activity within the Active Directory environment. Immediate investigation is recommended upon alert to determine the legitimacy and intent behind such changes.
This rule detects when the owner of an Active Directory object is updated. Changing an object's owner grants full control over that object, which can be a significant privilege escalation or a precursor to hiding an AD object. The rule specifically looks for EventCode 5136 in Windows Security Event Logs, filtering for changes in the 'owner' attribute.
This detection identifies an Active Directory access-control list (ACL) modification event, specifically focusing on changes that apply deny permissions to prevent enumeration of object permissions. Such modifications can be used by adversaries for persistence or to hide malicious objects within Active Directory by making them harder to discover.
This detection monitors the addition of dangerous Access Control Lists (ACLs) to an Active Directory user object. Specifically, it looks for modifications that grant "Full control", "All extended rights", "All validated writes", "Create all child objects", "Delete all child objects", "Delete subtree", "Delete", "Modify permissions", "Modify owner", or "Write all properties" to a user object. Such modifications can indicate potential privilege escalation or malicious activity within the Active Directory environment. Immediate investigation is recommended upon alert.
This rule detects the deletion of Access Control List (ACL) entries on the domain root object within Active Directory. Such an action is a significant change with high impact, as it can alter fundamental security permissions for the entire domain. Microsoft guidance suggests that all changes at this level should be reviewed. The rule extracts details about the old and new ACL values, the operation type, the affected object, and the user performing the action. It also attempts to resolve SIDs to user or group names for better context.
The following analytic detects modifications to default Group Policy Objects (GPOs) using the Group Policy Management Editor (GPME). It leverages the Endpoint data model to identify processes where `mmc.exe` executes `gpme.msc` with specific GUIDs related to default GPOs. This activity is significant because default GPOs, such as the `Default Domain Controllers Policy` and `Default Domain Policy`, are critical for enforcing security policies across the domain. If malicious, such modifications could allow an attacker to gain further access, establish persistence, or deploy malware across numerous hosts, severely compromising the network's security.
This rule detects when an Entra ID (formerly Azure Active Directory) conditional access policy has been modified. It specifically looks for 'USER_RESOURCE_UPDATE_CONTENT' events within Office 365, targeting the 'AzureActiveDirectory' application, where the 'extendedAuditEventCategory' is 'Policy' and the 'product_event_type' is 'Update policy.'. This indicates a change to a conditional access policy, which could be a legitimate administrative action or a malicious attempt to alter security controls.
Detects when an Entra ID conditional access policy has been modified
This rule detects changes to the device registration policy within Azure. Such modifications can be used by adversaries to evade defenses, escalate privileges, or enable unauthorized device registrations, potentially leading to broader access to the environment. The detection specifically looks for 'Set device registration policies' activity within the 'Policy' category of Azure Audit Logs.
Page 7 of 7