Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
119 detections
Filters
Last updated
All Time
Detection languages
63
30
9
6
4
Contributors
27
22
20
13
6
Categories
60
54
32
23
22
Platforms
100
11
9
5
5
Products / Services
64
35
13
12
6
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
5
1
1
1
IDS Classtypes
3
1
IDS Protocols
3
Time-series correlation detecting Pass-The-Hash authentication behavior immediately following the extraction of LSASS memory.
Detects SMB authentication attempts using NTLM with a blank Lan Manager (LM) hash. This specific pattern is often associated with Pass-the-Hash attacks where tools inject malformed or blank hashes to initiate authentication, a common indicator of lateral movement attempts.
This rule detects Nested App Authentication (NAA) broker abuse, specifically when the Azure Portal silently acquires Microsoft Graph tokens for privileged first-party nested applications. It correlates these silent token acquisitions with a preceding interactive Azure Portal sign-in from the same user and IP address within a 30-minute window, indicating a potential AiTM (Adversary-in-the-Middle) kill chain indicator. The rule identifies known vulnerable nested application IDs and looks for 'refreshToken' or 'broker' as the incoming token type during the Graph token acquisition.
This rule detects Nested App Authentication (NAA) broker abuse, specifically when the Azure Portal silently acquires Microsoft Graph tokens for privileged first-party nested applications. It correlates these silent token acquisitions with a preceding interactive Azure Portal sign-in from the same user and IP address within a 30-minute window, indicating a potential AiTM (Adversary-in-the-Middle) kill chain indicator. The rule identifies known vulnerable nested application IDs and looks for 'refreshToken' or 'broker' as the incoming token type during the Graph token acquisition.
Detects NTLM network logons (LogonType 3) where the workstation name does not match the target computer name and is not a machine account. This pattern is commonly associated with lateral movement techniques such as Pass-the-Hash or other credential relay attacks, where an adversary authenticates to a remote system using compromised credentials.
Detects potential Pass-the-Hash lateral movement where a single account uses NTLM authentication as a local administrator to access three or more distinct devices within a 30-minute window, a pattern often indicative of automated credential propagation.
Detects the exchange of FOCI refresh tokens across the Microsoft app family, a tactic utilized by Tycoon 2FA. This KQL query identifies successful sign-ins where a single user's session (CorrelationId) interacts with more than 3 distinct applications within a 5-minute window, indicating potential token abuse.
Detects Pass-the-Hash attacks using NTLM authentication over SMB
This rule detects potential Pass-the-Hash (PtH) attacks by looking for multiple successful network logons (LogonType 3) using NTLM authentication for the same user from the same IP address. A count of 5 or more such events is considered suspicious.
Detects SMB NTLM relay attacks used for credential capture and lateral movement
Detects registry changes affecting DisableRestrictedAdmin, specifically when it is set to '00000000' (disabled). This modification could weaken authentication protections or facilitate credential theft techniques by allowing the use of cached credentials for remote connections.
This rule detects SMB authentication attempts that might be indicative of a 'Pass-the-Hash' attack (ATT&CK T1550.002). It specifically looks for NTLMSSP (NT LAN Manager Security Support Provider) traffic on TCP port 445 (SMB) where the NTLM authentication message contains a specific sequence of null bytes, which can be characteristic of a hash being passed instead of a cleartext password.
Detects reuse of alternate authentication materials like tokens or cookies
This rule detects potential Pass-the-Hash (PtH) attacks by looking for multiple successful network logons (LogonType 3) using NTLM authentication for the same user from the same IP address. A count of 5 or more such events is considered suspicious.
Detects registry changes affecting DisableRestrictedAdmin, specifically when it is set to '00000000' (disabled). This modification could weaken authentication protections or facilitate credential theft techniques by allowing the use of cached credentials for remote connections.
Monitors for modifications to the LocalAccountTokenFilterPolicy registry key being set to 1, a technique used by the IOX proxy (and SHADOW-EARTH-053) to enable Pass-the-Hash attacks and grant administrative rights to remote connections.
This hunt targets a documented Iranian MOIS-affiliated behaviour: re-executing DCSync
(MITRE ATT&CK T1003.006 — OS Credential Dumping: DCSync) after defenders reset
compromised account passwords, allowing actors to recollect current and historical NTLM
hashes and restore domain-wide access without repeating initial access stages.
(MITRE ATT&CK T1003.006 — OS Credential Dumping: DCSync) after defenders reset
compromised account passwords, allowing actors to recollect current and historical NTLM
hashes and restore domain-wide access without repeating initial access stages.
Detects potential NTLM credential leakage caused by SnippingTool.exe making outbound network connections (SMB / Web) that result in NTLM authentication, consistent with CVE‑2026‑33829 exploitation.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32631
Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module.
Detects the attack technique pass the hash which is used to move laterally inside the network
Page 4 of 6