Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
208 detections
Filters
Last updated
All Time
Detection languages
101
42
20
14
12
Contributors
66
35
26
14
14
Categories
153
105
57
39
26
Platforms
146
106
58
12
7
Products / Services
47
27
26
23
21
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
3
3
1
1
1
IDS Classtypes
1
1
IDS Protocols
1
1
Detects modifications to the 'SSLKEYLOGFILE' environment variable in the Windows Registry. This variable is often used by applications like web browsers to log SSL/TLS session keys to a file, which can then be used to decrypt encrypted network traffic. Malicious actors might enable this to capture sensitive data.
KQL Query from file: Detecting GOLDEN SAML Attack
This analytic detects the use of the PowerShell Cmdlet `export-certificate` by leveraging Script Block Logging. This activity is significant as it may indicate an adversary attempting to exfiltrate certificates from the local Certificate Store on a Windows endpoint. Monitoring this behavior is crucial because stolen certificates can be used to impersonate users, decrypt sensitive data, or facilitate further attacks. If confirmed malicious, this activity could lead to unauthorized access to encrypted communications and sensitive information, posing a severe security risk.
The analytic detects the use of the PowerShell cmdlet `export-pfxcertificate` by leveraging Script Block Logging. This activity is significant as it may indicate an adversary attempting to exfiltrate certificates from the Windows Certificate Store. Monitoring this behavior is crucial for identifying potential certificate theft, which can lead to unauthorized access and impersonation attacks. If confirmed malicious, this activity could allow attackers to compromise secure communications, authenticate as legitimate users, and escalate their privileges within the network.
Adversaries may search for private key certificate files on compromised systems for insecurely stored credential
A general detection for processes creating PFX files. This could be an indicator of an adversary exporting a local certificate to a PFX file.
Adversaries may search for private key certificate files on compromised systems for insecurely stored credential
Detects calls to cmdlets inside of PowerShell scripts that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.
'This detection uses Windows security events to look for users reading the local Device Identity Key (Machine Key).
This information can be correlated with other events for additional context and get to use-cases where a
machine key with a transport key together can be used to impersonate an Entra ID joined or registered machine.
Reference: https://o365blog.com/post/deviceidentity/'
This information can be correlated with other events for additional context and get to use-cases where a
machine key with a transport key together can be used to impersonate an Entra ID joined or registered machine.
Reference: https://o365blog.com/post/deviceidentity/'
Private Key Files.
This query identifies file operation with files having.
One of the extensions commonly used to save a private.
Key. The risk is that if an attacker were to obtain.
The file, they could brute force any password on it.
And potentially obtain a powerful certificate. To do.
This, they would only need to obtain read access to.
The file.
The risk associated with these files is heavily.
Determined by the value of the certificate. For example,.
Loss of a self-signed certificate created by Adobe Acrobat.
Is significantly less impactful than loss of a website.
SSL certificate.
Recommendation: Know where these files are, and if possible.
Back them up and remove them. You might also consider.
Creating an informational alert.
This query identifies file operation with files having.
One of the extensions commonly used to save a private.
Key. The risk is that if an attacker were to obtain.
The file, they could brute force any password on it.
And potentially obtain a powerful certificate. To do.
This, they would only need to obtain read access to.
The file.
The risk associated with these files is heavily.
Determined by the value of the certificate. For example,.
Loss of a self-signed certificate created by Adobe Acrobat.
Is significantly less impactful than loss of a website.
SSL certificate.
Recommendation: Know where these files are, and if possible.
Back them up and remove them. You might also consider.
Creating an informational alert.
Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.
Detects a "Get-Process" cmdlet and it's aliases on lsass process, which is in almost all cases a sign of malicious activity
Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.
Detects a "Get-Process" cmdlet and it's aliases on lsass process, which is in almost all cases a sign of malicious activity
Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.
wifikeys
KQL
Detect if someone run netsh and try to expose WPA keys in clear text
@mattiasborg82.
Blog.sec-labs.com.
@mattiasborg82.
Blog.sec-labs.com.
'This detection uses Security events from the "AD FS Auditing" provider to detect suspicious object identifiers (OIDs) as part EventID 501 and specifically part of the Enhanced Key Usage attributes.
This query checks to see if you have any new OIDs in the last hour that have not been seen in the previous day. New OIDs should be validated and OIDs that are very long, as indicated
by the OID_Length field, could also be an indicator of malicious activity.
In order to use this query you need to enable AD FS auditing on the AD FS Server.
References:
https://www.microsoft.com/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/
https://docs.microsoft.com/windows-server/identity/ad-fs/troubleshooting/ad-fs-tshoot-logging
'
This query checks to see if you have any new OIDs in the last hour that have not been seen in the previous day. New OIDs should be validated and OIDs that are very long, as indicated
by the OID_Length field, could also be an indicator of malicious activity.
In order to use this query you need to enable AD FS auditing on the AD FS Server.
References:
https://www.microsoft.com/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/
https://docs.microsoft.com/windows-server/identity/ad-fs/troubleshooting/ad-fs-tshoot-logging
'
This rule detects attempts to access the Active Directory contact object to read the AD FS Distributed Key Manager (DKM) master key value. This activity is identified by monitoring Windows Security Event ID 4662 (An operation was performed on an object) for specific property GUIDs associated with the DKM master key, combined with a successful user login event (Event ID 4624) from the same host within a 5-minute window. This indicates a potential attempt to compromise AD FS for credential theft or persistence.
This rule detects the creation of files with specific naming conventions and extensions that are indicative of exported or stolen DPAPI backup keys and certificates. These patterns are commonly associated with tools like Mimikatz and DSInternals, which adversaries use to extract credentials and cryptographic material from Windows systems. The rule looks for filenames containing "ntds_capi_", "ntds_legacy_", or "ntds_unknown_" and ending with ".cer", ".key", ".pfx", or ".pvk".
Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.
ADFS DKM Key Access
YARA-L
Detects access to the AD contact object to read the AD FS DKM (distributed key manager) master key value
Page 9 of 10