Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
208 detections
Filters
Last updated
All Time
Detection languages
101
42
20
14
12
Contributors
66
35
26
14
14
Categories
153
105
57
39
26
Platforms
146
106
58
12
7
Products / Services
47
27
26
23
21
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
3
3
1
1
1
IDS Classtypes
1
1
IDS Protocols
1
1
This rule detects the execution and usage of the DSInternals PowerShell module. DSInternals is a powerful tool that exposes internal features of Active Directory and Azure Active Directory, enabling actions such as dumping DPAPI backup keys, manipulating NTDS.DIT files, auditing FIDO2 and NGC keys, performing password auditing, and recovering Domain Controllers from IFM backups. The rule specifically looks for a wide range of DSInternals cmdlets being executed via the command line.
The following analytic detects the export of a certificate from the Windows Certificate Store. It leverages the Certificates Lifecycle log channel, specifically event ID 1007, to identify this activity. Monitoring certificate exports is crucial as certificates can be used for authentication to VPNs or private resources. If malicious actors export certificates, they could potentially gain unauthorized access to sensitive systems or data, leading to significant security breaches.
This analytic identifies the use of `certutil.exe` with arguments indicating the manipulation or extraction of certificates. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because extracting certificates can allow attackers to sign new authentication tokens, particularly in federated environments like Windows ADFS. If confirmed malicious, this could enable attackers to forge authentication tokens, potentially leading to unauthorized access and privilege escalation within the network.
This analytic identifies processes that retrieve information related to private key files, often used by post-exploitation tools like winpeas. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that search for private key certificates. This activity is significant as it indicates potential attempts to locate insecurely stored credentials, which adversaries can exploit for privilege escalation, persistence, or remote service authentication. If confirmed malicious, this behavior could allow attackers to access sensitive information, escalate privileges, or maintain persistence within the compromised environment.
This analytic detects suspicious attempts to find private keys and certificates on Linux systems, which may indicate an attacker's effort to access sensitive cryptographic information. Private keys are crucial for securing encrypted communications and data, and unauthorized access to them can lead to severe security breaches, including data decryption and identity theft. By monitoring for unusual or unauthorized searches for files with common private key and certificate extensions using commands like 'find' or 'grep', this analytic helps identify potential threats to cryptographic security, enabling security teams to take swift action to protect the integrity and confidentiality of encrypted information.
This rule identifies when an encryption key file is accessed (downloaded, viewed, or copied) by an anonymous user in Google Drive. This activity could indicate an adversary attempting to gain access to sensitive encryption keys before moving laterally or compromising data.
This rule detects the usage of a Google Cloud Platform (GCP) service account key from more than two distinct countries within a one-hour period. It leverages GeoIP enrichment data from Chronicle to identify the geographical origin of the IP addresses making the API calls. This behavior can indicate a compromised service account key being used by an attacker from multiple locations, potentially to evade detection or perform malicious activities across different regions.
Detects usage of service account key from multiple countries using Chronicle GeoIP enrichment.
Identifies when an encryption key file is accessed by an anonymous user in Google Drive. An adversary may attempt to access encryption keys before moving laterally and compromising sensitive data.
This rule detects commands executed on Cisco network devices related to the export of private keys or the import/management of PKI certificates. Specifically, it looks for the commands 'crypto pki export', 'crypto pki import', and 'crypto pki trustpoint'. These actions can indicate an attempt to exfiltrate sensitive cryptographic material (private keys) or to establish new trusted certificates, which could be used for defense evasion or to facilitate man-in-the-middle attacks.
Detects network access to the 'protected_storage' service, specifically targeting the IPC$ share. This activity is often associated with attempts to extract DPAPI domain backup keys from Domain Controllers, a technique used for credential access and lateral movement.
Detects PowerShell script blocks that contain commands used to export certificates from the local certificate store. This activity can be abused by threat actors to steal private keys from compromised machines.
Detects calls to PowerShell cmdlets used to export certificates from the local certificate store. Threat actors have been observed abusing this technique to steal private keys from compromised machines, which can then be used for authentication or decryption.
This rule detects attempts to discover private key files using command-line tools such as `cmd.exe`, `powershell.exe`, or `findstr.exe`. It specifically looks for commands that include common private key file extensions like .key, .pgp, .gpg, .ppk, .p12, .pem, .pfx, .cer, .p7b, and .asc. This activity is indicative of an adversary searching for insecurely stored credentials on a compromised system.
Detects calls to cmdlets inside of PowerShell scripts that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.
Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.
Adversaries may search for private key certificate files on compromised systems for insecurely stored credential
Detects a "Get-Process" cmdlet and it's aliases on lsass process, which is in almost all cases a sign of malicious activity
Yara rule that detects CVE-2020-0601 exploit.
Page 10 of 10