Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
62 detections
Filters
Last updated
All Time
Detection languages
33
15
9
2
1
Contributors
13
10
8
7
7
Categories
34
17
12
11
10
Platforms
55
4
3
1
1
Products / Services
32
19
15
11
8
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
1
1
IDS Classtypes
1
IDS Protocols
1
Detects the execution of the hacktool Rubeus using specific command line flags within PowerShell script block logs. This rule identifies various Kerberos-related attacks such as AS-REPRoasting, Kerberoasting, Pass-the-Ticket, Golden Ticket, and Silver Ticket attacks, as well as credential harvesting and dumping.
Detects the execution of the hacktool Rubeus via PE information or command line parameters. Rubeus is a C# toolset designed for raw Kerberos interaction, often used for credential access, Kerberoasting, and pass-the-ticket attacks.
Detects the execution of KrbRelayUp, a hack tool used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced. The rule identifies the tool by its executable name or original filename and specific command-line arguments associated with its relay, krbscm, and spawn functionalities.
The analytic detects the execution of Mimikatz commands via PowerShell by leveraging PowerShell Script Block Logging (EventCode=4104). This method captures and logs the full command sent to PowerShell, allowing for the identification of suspicious activities such as Pass the Ticket, Pass the Hash, and credential dumping. This activity is significant as Mimikatz is a well-known tool used for credential theft and lateral movement. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information within the environment.
KQL Query from file: AWS NoSuchBucket Check
KQL Query
KQL Query from file: CVE-2025-24054 NTLM Exploit in the Wild Detection
KQL Query from file: CVE-2024-38200 NTLM Exposure Detection
Detects the execution of the hacktool Rubeus via PE information of command line parameters
Detects the execution of the hacktool Rubeus using specific command line flags
Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.
Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced
Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.
Detects the execution of the hacktool Rubeus via PE information of command line parameters
Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced
The analytic detects the use of Rubeus command line parameters, a toolset for Kerberos attacks within Active Directory environments. It leverages Endpoint Detection and Response (EDR) data to identify specific command-line arguments associated with actions like ticket manipulation, kerberoasting, and password spraying. This activity is significant as Rubeus is commonly used by adversaries to exploit Kerberos for privilege escalation and lateral movement. If confirmed malicious, this could lead to unauthorized access, persistence, and potential compromise of sensitive information within the network.
The analytic detects the use of NetExec (formerly CrackMapExec), a toolset for post-exploitation enumeration and attack within Active Directory environments, by identifying specific command-line arguments. It leverages Endpoint Detection and Response (EDR) data to detect actions like ticket manipulation, Kerberoasting, and password spraying. This activity is significant as NetExec is used by adversaries to exploit Kerberos for privilege escalation and lateral movement, potentially leading to unauthorized access, persistence, and compromise of sensitive information.
The following analytic detects a process accessing the winlogon.exe system process, indicative of the Rubeus tool attempting to export Kerberos tickets from memory. This detection leverages Sysmon EventCode 10 logs, focusing on processes obtaining a handle to winlogon.exe with specific access rights. This activity is significant as it often precedes pass-the-ticket attacks, where adversaries use stolen Kerberos tickets to move laterally within an environment. If confirmed malicious, this could allow attackers to bypass normal access controls, escalate privileges, and persist within the network, posing a severe security risk.
The analytic detects a Kerberos Ticket Granting Ticket (TGT) request using RC4-HMAC encryption (type 0x17) by leveraging Event 4768. This encryption type is outdated and its presence may indicate an OverPass The Hash attack. Monitoring this activity is crucial as it can signify credential theft, allowing adversaries to authenticate to the Kerberos Distribution Center (KDC) using a stolen NTLM hash. If confirmed malicious, this could enable unauthorized access to systems and resources, potentially leading to lateral movement and further compromise within the network.
The following analytic detects the use of Mimikatz command line parameters associated with pass-the-ticket attacks. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line patterns related to Kerberos ticket manipulation. This activity is significant because pass-the-ticket attacks allow adversaries to move laterally within an environment using stolen Kerberos tickets, bypassing normal access controls. If confirmed malicious, this could enable attackers to escalate privileges, access sensitive information, and maintain persistence within the network.
Page 3 of 3