Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
62 detections
Filters
Last updated
All Time
Detection languages
33
15
9
2
1
Contributors
13
10
8
7
7
Categories
34
17
12
11
10
Platforms
55
4
3
1
1
Products / Services
32
19
15
11
8
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
1
1
IDS Classtypes
1
IDS Protocols
1
Detects anomalous authentication behavior where a user account utilizes the same authentication session (LogonId) or material to authenticate across multiple distinct destination hosts in a short timeframe. This rule monitors for both NTLM (Type 3) and Kerberos (TGS/TGT) events, which are indicative of lateral movement techniques such as Pass-the-Hash or Pass-the-Ticket.
Detects anomalous authentication behavior where a user account utilizes the same authentication session (LogonId) or material to authenticate across multiple distinct destination hosts in a short timeframe. This rule monitors for both NTLM (Type 3) and Kerberos (TGS/TGT) events, which are indicative of lateral movement techniques such as Pass-the-Hash or Pass-the-Ticket.
Detects Kerberos TGT requests (Event ID 4768) that utilize RC4 (PreAuthType 23) for pre-authentication. This is a common indicator of an Overpass-the-Hash attack, where an adversary uses a stolen NTLM hash to authenticate as a user and request a Kerberos ticket in environments that are typically configured for AES encryption.
Detects anomalous authentication behavior where a user account utilizes the same authentication session (LogonId) or material to authenticate across multiple distinct destination hosts in a short timeframe. This rule monitors for both NTLM (Type 3) and Kerberos (TGS/TGT) events, which are indicative of lateral movement techniques such as Pass-the-Hash or Pass-the-Ticket.
Detects anomalous authentication behavior where a user account utilizes the same authentication session (LogonId) or material to authenticate across multiple distinct destination hosts in a short timeframe. This rule monitors for both NTLM (Type 3) and Kerberos (TGS/TGT) events, which are indicative of lateral movement techniques such as Pass-the-Hash or Pass-the-Ticket.
Detects the execution of the hacktool Rubeus using specific command line flags
Detects Defender XDR alerts and evidence potentially related to Certighost / CVE-2026-54121 AD CS abuse, including suspicious certificate requests, Kerberos activity, LDAP security principal anomalies, and possible DCSync or directory replication abuse.
This KQL is designed to hunt for activity that may indicate Active Directory Certificate Services abuse or Certighost-like domain compromise behavior, especially where an attacker may manipulate machine account attributes, impersonate domain-controller-like behavior, or perform follow-on credential extraction.
This rule detects potential lateral movement activity by monitoring for Kerberos service ticket requests (Event ID 4769) and Kerberos-based network logons (Event ID 4624, Logon Type 3) originating from source IP addresses that deviate from an account's established baseline of activity over the previous 14 days.
This rule detects potential lateral movement activity by monitoring for Kerberos service ticket requests (Event ID 4769) and Kerberos-based network logons (Event ID 4624, Logon Type 3) originating from source IP addresses that deviate from an account's established baseline of activity over the previous 14 days.
This rule detects potential exploitation of the CVE-2026-48558 vulnerability in SimpleHelp servers by monitoring for specific sequences of log markers related to authentication bypass and unauthorized configuration changes. It flags anomalous technician registrations, OIDC attribute fetching, and 'New Anon' configuration saves within a 60-second window, which are indicative of an attacker attempting to gain unauthorized access or manipulate session security.
Detects the execution of Rubeus or Mimikatz with command-line arguments indicative of Kerberos attacks such as Pass the Ticket (PtT) or Golden Ticket generation. This rule specifically looks for keywords like 'rubeus ptt', 'kerberos::ptt', 'kerberos::golden', and 'mimikatz kerberos' in process command lines.
Detects unauthorized processes reading, copying, or renaming Kerberos ticket cache files (ccache) located in common temporary directories. This behavior is often associated with credential theft and potential Pass the Ticket attacks where adversaries attempt to extract session credentials to perform lateral movement or privilege escalation.
Detects unauthorized processes reading, copying, or renaming Kerberos ticket cache files (ccache) located in common temporary directories. This behavior is often associated with credential theft and potential Pass the Ticket attacks where adversaries attempt to extract session credentials to perform lateral movement or privilege escalation.
Detects unauthorized processes reading, copying, or renaming Kerberos ticket cache files (ccache) located in common temporary directories. This behavior is often associated with credential theft and potential Pass the Ticket attacks where adversaries attempt to extract session credentials to perform lateral movement or privilege escalation.
Detects Pass-the-Ticket attacks using stolen Kerberos tickets
This rule detects potential Kerberos 'Pass the Ticket' (PtT) attacks, specifically focusing on the reuse of Kerberos Ticket Granting Tickets (TGTs). It triggers when UDP traffic to port 88 (Kerberos) on the home network contains the byte sequence '|6b|' at the beginning of the payload, and this activity occurs 10 times within 5 seconds from the same source IP. The '6b' byte often indicates a Kerberos AP-REQ message, which is used to request access to a service. Repeated AP-REQ messages from the same source could indicate TGT reuse.
Detects the execution of the hacktool Rubeus via PE information of command line parameters
Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.
Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced
This rule detects uncommon outbound network connections on TCP port 88, which is the default port for Kerberos. Such activity, especially from processes other than expected system services like LSASS or common applications like web browsers and Tomcat, can indicate potential lateral movement or initial privilege escalation attempts through Kerberos delegation. Attackers often leverage Kerberos for authentication in Windows environments to move between systems or elevate privileges, for example, using tools like Rubeus for Kerberoasting or other Kerberos-based attacks.
Page 2 of 3