Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
31 detections
Filters
Last updated
All Time
Detection languages
18
6
2
2
2
Contributors
10
8
3
3
2
Categories
15
14
10
5
2
Platforms
29
2
2
Products / Services
6
6
4
3
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
2
IDS Protocols
2
Detects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID
Detects Access to Domain Group Policies stored in SYSVOL
Detects file access requests to potentially sensitive files hosted on the Windows Sysvol share by applications that are not commonly expected to access these files. This can indicate an attempt to gather credentials or configuration details from Group Policy Objects.
Detects file access requests to potentially sensitive files hosted on the Windows Sysvol share.
The following analytic detects the use of the findstr command to search for unsecured credentials in Group Policy Preferences (GPP). It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving findstr.exe with references to SYSVOL and cpassword. This activity is significant because it indicates an attempt to locate and potentially decrypt embedded credentials in GPP, which could lead to unauthorized access. If confirmed malicious, this could allow an attacker to escalate privileges or gain access to sensitive systems and data within the domain.
Detects file access requests to the Windows Sysvol Policies Share by processes that are not commonly expected to interact with these files. This could indicate an adversary attempting to discover or exploit Group Policy Preferences for credential access or other malicious purposes.
Detects suspicious shell commands commonly used in various exploit codes, including those associated with Apache Struts vulnerabilities and Metasploit framework activities. The rule looks for patterns indicative of downloading and executing scripts, setting up reverse shells, or modifying file permissions for persistence or privilege escalation.
This rule detects the use of `find.exe` or `findstr.exe` to search for the string 'cpassword' within XML files located in the SYSVOL share. This activity is indicative of an adversary attempting to locate encrypted Group Policy Preferences (GPP) passwords, which can then be decrypted to obtain credentials.
Detects suspicious access to Domain Group Policies stored in the SYSVOL share. This rule specifically looks for command-line activity that includes both '\SYSVOL\' and '\policies\', indicating an attempt to interact with Group Policy objects.
Detects Access to Domain Group Policies stored in SYSVOL
Page 2 of 2