Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
119 detections
Filters
Last updated
All Time
Detection languages
63
30
9
6
4
Contributors
27
22
20
13
6
Categories
60
54
32
23
22
Platforms
100
11
9
5
5
Products / Services
64
35
13
12
6
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
5
1
1
1
IDS Classtypes
3
1
IDS Protocols
3
KQL Query from file: Malicious FIDO2 Registration Threat Detection
KQL Query
KQL Query from file: NTLMv2 Hash Leak via COM Detection
This analytic detects the execution of the Invoke-WMIExec utility within PowerShell Script Block Logging (EventCode 4104). This detection leverages PowerShell script block logs to identify instances where the Invoke-WMIExec command is used. Monitoring this activity is crucial as it indicates potential lateral movement using WMI commands with NTLMv2 pass-the-hash authentication. If confirmed malicious, this activity could allow an attacker to execute commands remotely on target systems, potentially leading to further compromise and lateral spread within the network.
Detects the attack technique pass the hash which is used to move laterally inside the network
Detects the attack technique pass the hash which is used to move laterally inside the network
Hacktool Ruler
Sigma
This events that are generated when using the hacktool Ruler by Sensepost
NTLM Logon
Sigma
Detects logons using NTLM, which could be caused by a legacy source or attackers
Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module.
Detects the reporting of NTLMv1 being used between a client and server. NTLMv1 is insecure as the underlying encryption algorithms can be brute-forced by modern hardware.
Microsoft Defender for Identity raises alert on suspicious Kerberos ticket, pointing to a potential overpass-the-hash attack.
Once attackers gain credentials for a user with higher privileges, they will use the stolen credentials to sign into other devices and move laterally.
This query finds related sign-in events following overpass-the-hash attack to trace the footprint of the impersonated user.
Once attackers gain credentials for a user with higher privileges, they will use the stolen credentials to sign into other devices and move laterally.
This query finds related sign-in events following overpass-the-hash attack to trace the footprint of the impersonated user.
This query will hunt for files matching the current abuse.ch recent threat feed based on Sha256. Currently the query is set up to analyze the last day worth of events, but this is configurable using the MaxAge variable.
The analytic detects a Kerberos Ticket Granting Ticket (TGT) request using RC4-HMAC encryption (type 0x17) by leveraging Event 4768. This encryption type is outdated and its presence may indicate an OverPass The Hash attack. Monitoring this activity is crucial as it can signify credential theft, allowing adversaries to authenticate to the Kerberos Distribution Center (KDC) using a stolen NTLM hash. If confirmed malicious, this could enable unauthorized access to systems and resources, potentially leading to lateral movement and further compromise within the network.
Detects the use of NTLMv1 for authentication between a client and server. NTLMv1 is an insecure authentication protocol due to its susceptibility to brute-force attacks against its underlying encryption algorithms. This rule identifies events logged by the LsaSrv provider indicating NTLMv1 usage.
Page 6 of 6