Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
119 detections
Filters
Last updated
All Time
Detection languages
63
30
9
6
4
Contributors
27
22
20
13
6
Categories
60
54
32
23
22
Platforms
100
11
9
5
5
Products / Services
64
35
13
12
6
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
5
1
1
1
IDS Classtypes
3
1
IDS Protocols
3
NTLM Logon
Sigma
Detects logons using NTLM, which could be caused by a legacy source or attackers
Hacktool Ruler
Sigma
This events that are generated when using the hacktool Ruler by Sensepost
Detects the reporting of NTLMv1 being used between a client and server. NTLMv1 is insecure as the underlying encryption algorithms can be brute-forced by modern hardware.
This rule detects two related scenarios: 1. Device Code Phishing: Correlates successful device code authentications with subsequent device registrations for the same user within a short time frame. This can indicate an attacker using a phished device code to register a new device. 2. Primary Refresh Token (PRT) Device Registration: Identifies device registrations that occur after an authentication to the Device Registration Service using a Primary Refresh Token. This pattern is indicative of an attacker minting a PRT and then using it to register or join a device, potentially bypassing conditional access policies.
This rule is meant to help analysts quickly spot a high-confidence indicator related to Google NetNTLMv1 Deprecation RainbowTables. It is written to be easy to understand and to keep false alarms low by focusing on a very specific match: a Windows logon event that explicitly shows LM or NTLMv1 as the package used. A match does not automatically prove an attacker is currently active, and it does not prove a file was executed, but it does mean the event is important because it lines up with a public threat intelligence source. When this triggers, start by identifying the host, user, and timeframe involved, then decide whether the activity is expected for that system. If it is unexpected, preserve the related logs and any files, and look for nearby events that could explain how the indicator appeared, such as a download, a new process, or a new connection. If the same indicator appears on multiple systems, treat it as a scoping signal and expand the investigation window. Use the reference link (https://cloud.google.com/blog/topics/threat- intelligence/net-ntlmv1-deprecation-rainbow-tables) to document where the indicator came from and to support incident notes and reporting.
This rule is meant to help analysts quickly spot a high-confidence indicator related to Google NetNTLMv1 Deprecation RainbowTables. It is written to be easy to understand and to keep false alarms low by focusing on a very specific match: a Windows logon event that explicitly shows LM or NTLMv1 as the package used. A match does not automatically prove an attacker is currently active, and it does not prove a file was executed, but it does mean the event is important because it lines up with a public threat intelligence source. When this triggers, start by identifying the host, user, and timeframe involved, then decide whether the activity is expected for that system. If it is unexpected, preserve the related logs and any files, and look for nearby events that could explain how the indicator appeared, such as a download, a new process, or a new connection. If the same indicator appears on multiple systems, treat it as a scoping signal and expand the investigation window. Use the reference link (https://cloud.google.com/blog/topics/threat- intelligence/net-ntlmv1-deprecation-rainbow-tables) to document where the indicator came from and to support incident notes and reporting.
Detects a network connection to an external SMB or WebDAV server immediately following the launch of a .url file. This behavior is associated with CVE-2024-43451, where threat actors use malicious .url files to leak NTLM hashes.
Detects an NTLM authentication attempt with an empty username field. This is a key indicator of the NTLM LDAP authentication bypass vulnerability (CVE-2025-54918), where an attacker coerces a SYSTEM account authentication and relays it to LDAP.
This rule detects potential Pass the Hash (PtH) activity by monitoring Windows Security Event IDs 4624 (successful logon) and 4625 (failed logon) where the LogonType is 3 (Network) and the LogonProcessName is 'NtLmSsp'. It specifically filters out 'ANONYMOUS LOGON' to reduce false positives. This combination of events indicates an attempt to authenticate over the network using NTLM, which is characteristic of PtH attacks for lateral movement.
Detects the attack technique pass the hash which is used to move laterally inside the network
Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior, often associated with tools like Mimikatz's sekurlsa::pth module. This indicates an adversary is using stolen password hashes to authenticate to a system.
This rule detects the use of the hacktool Ruler by Sensepost, specifically looking for 'RULER' in the Workstation or WorkstationName fields of Windows Security Event IDs 4776 (Credential Validation) and 4624/4625 (Logon/Logoff). Ruler is a tool designed to abuse Microsoft Exchange services.
Detects logons using NTLM authentication, which can indicate the presence of legacy systems or be leveraged by attackers for lateral movement or credential access. Event ID 8002 specifically indicates an NTLM authentication event.
This rule detects modifications to the 'NoLMHash' registry value, specifically when it is set to '0' (DWORD). Setting this value to '0' allows Windows to store LAN Manager (LM) hashes of user passwords in Active Directory and local Security Account Manager (SAM) databases. This action significantly weakens security as LM hashes are highly vulnerable to cracking, making credential theft easier for attackers. Attackers often enable LM hash storage to facilitate 'Pass the Hash' attacks or offline password cracking.
Detects changes to the "NoLMHash" registry value to allow Windows to store LM Hashes. Setting this registry value to "0" (DWORD) enables the storage of LAN manager hashes of passwords in Active Directory and local SAM databases, which can facilitate 'Pass the Hash' attacks.
The analytic detects the execution of Mimikatz commands via PowerShell by leveraging PowerShell Script Block Logging (EventCode=4104). This method captures and logs the full command sent to PowerShell, allowing for the identification of suspicious activities such as Pass the Ticket, Pass the Hash, and credential dumping. This activity is significant as Mimikatz is a well-known tool used for credential theft and lateral movement. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information within the environment.
Detects multiple Event ID 4648 logon attempts using the same target account but from different source accounts within a short time window. This behavior may indicate lateral movement, credential stuffing, or misuse of shared credentials. By correlating explicit credential use across users, it helps identify possible compromise or abuse of privileged accounts.
Detects scenarios where an attacker uses the Mimikatz Pass-the-hash feature to move laterally. Correlation with others event IDs can be done in the following way:| ID 4624 TargetLogonId + ID 4672 SubjectLogonId + ID 4688 TargetLogonId. Having those 3 elements together allows to bring in light what was exactly done.
Detects suspicious SMB/NTLM activity triggered by explorer.exe following recent .lnk file creation by script engines. This behavior aligns with the CVE-2025-50154 bypass of Microsoft’s NTLM credential leak patch (CVE-2025-24054), allowing zero-click NTLM hash disclosure and remote binary staging without execution.
NTLM Relay Attempt
YARA-L
Detects NTLM successful network logons where the source and destination workstations are the same, excluding loopback addresses. This behavior can be indicative of NTLM relay attacks where an attacker relays authentication from a victim to the victim's own machine, or other forms of NTLM abuse.
Detects suspicious reuse of NTLM authentication hashes by the same user account across multiple hosts within a short time window. This behavior may indicate lateral movement techniques such as pass-the-hash attacks or credential replay.
Page 5 of 6