Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9 detections
Filters
Last updated
All Time
Detection languages
4
2
1
1
1
Contributors
2
2
1
1
1
Categories
5
2
2
2
2
Platforms
4
4
1
1
Products / Services
2
1
1
1
1
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
1
IDS Protocols
1
Detects modifications to the 'msDS-KeyCredentialLink' attribute on user or computer objects within Active Directory. This attribute is targeted in 'Shadow Credentials' attacks (e.g., using tools like Whisker, pyWhisker, or DSInternals) to add an attacker-controlled public key, allowing for PKINIT-based authentication as the victim account without knowing the password.
Detects modification of network device AAA authentication to allow bypass
This rule detects a potential network device authentication bypass attempt via SSH. Specifically, it looks for SSH traffic (port 22) directed to the home network that contains the strings "aaa authentication" and "none" (case-insensitive). This combination suggests a configuration where authentication, authorization, and accounting (AAA) is set to 'none', which could allow unauthorized access.
Cisco Dot1x Disabled
Sigma
Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface.
Disabling dot1x bypasses Network Access Control (NAC) mechanisms, potentially allowing unauthorized devices to gain access to the internal network.
This activity is a common technique used by attackers or malicious insiders to establish persistence or perform lateral movement via rogue devices.
Disabling dot1x bypasses Network Access Control (NAC) mechanisms, potentially allowing unauthorized devices to gain access to the internal network.
This activity is a common technique used by attackers or malicious insiders to establish persistence or perform lateral movement via rogue devices.
This detection identifies cases where a successful device registration event in Azure AD occurs shortly after a successful Resource Owner Password Credentials (ROPC) authentication to Microsoft Intune Enrollment via the Microsoft Authentication Broker.
Microsoft allows specific application and resource combinations access without a previously registered device.
An access token issued for the Microsoft Authentication Broker application and the Intune Enrollment resource can be used to authenticate and initiate the device join process.
An attacker can leverage the token to bypass CA, register device, and establish persistence. Once registered, attacker gets a Primary Refresh Token (PRT), valid for 90 days.
The following query joins ROPC successful sign-ins, to successful device registrations. Registrations that occur soon after a ROPC event (2 days in this instance) could be an indicator of abuse.
Microsoft allows specific application and resource combinations access without a previously registered device.
An access token issued for the Microsoft Authentication Broker application and the Intune Enrollment resource can be used to authenticate and initiate the device join process.
An attacker can leverage the token to bypass CA, register device, and establish persistence. Once registered, attacker gets a Primary Refresh Token (PRT), valid for 90 days.
The following query joins ROPC successful sign-ins, to successful device registrations. Registrations that occur soon after a ROPC event (2 days in this instance) could be an indicator of abuse.
Detects potential exploitation of Microsoft Entra ID (formerly Azure AD) by attackers who abuse app role permissions to backdoor federated domains and escalate to Global Administrator using forged SAML tokens
KQL Query from file: Attacker in the Middle Precision Detection
KQL Query from file: Entra Passkey Addition Threat Detection
This analytic identifies new login attempts to network routers. It uses authentication logs from the ES Assets and Identity Framework, specifically looking for assets categorized as 'router'. The rule flags connections that have not been observed in the past 30 days. Unauthorized access to routers is critical as it can lead to network disruptions, data interception, or further compromise of the network infrastructure.
