Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
114 detections
Filters
Last updated
All Time
Detection languages
45
44
14
5
3
Contributors
24
23
14
10
9
Categories
76
40
15
13
12
Platforms
106
3
2
1
1
Products / Services
65
49
43
11
5
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
4
2
2
1
1
IDS Classtypes
1
IDS Protocols
1
Detects a highly relevant Antivirus alert that reports a password dumper. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This rule detects potential exploitation attempts of CVE-2021-42278, also known as "noPac" or "sAMAccountName spoofing". The exploit involves an attacker creating a computer object with known credentials, then clearing its ServicePrincipalName (SPN) attribute. This manipulation grants the attacker additional permissions on the object, allowing them to make further changes. The detection logic specifically looks for Kerberos Key Distribution Center (KDC) events (EventIDs 35, 36, 37, 38) which indicate anomalies in PAC (Privilege Attribute Certificate) or ticket requests, consistent with the post-exploitation phase of CVE-2021-42278 where forged tickets are used.
Detects failed Kerberos TGT issue operations. This can be a sign of manipulations of TGT messages by an attacker, potentially indicating attempts to exploit Kerberos for credential access or to bypass authentication mechanisms.
Detects the execution of the KrbRelay tool, a utility used for Kerberos relaying attacks. The rule identifies the tool by its executable name ('KrbRelay.exe') or its original filename, and by specific command-line arguments commonly used by KrbRelay for Kerberos relaying, including parameters related to Service Principal Names (SPN), Class IDs (CLSID), and Resource-Based Constrained Delegation (RBCD) or shadow credentials.
Detects when an Office application loads the 'kerberos.dll' library. This behavior is unusual for standard Office operations and could indicate an attempt to manipulate Kerberos authentication, potentially for credential access or privilege escalation.
This rule detects a potential Kerberos Replay Attack on domain controllers. It specifically looks for Event ID 4649, which indicates that a "KRB_AP_ERR_REPEAT" Kerberos response was sent to the client. This error signifies that the KDC detected a replay of a Kerberos Application Server (AP) request, suggesting an adversary might be attempting to reuse stolen Kerberos tickets to gain unauthorized access.
Detects the creation of specific files commonly associated with Mimikatz, a credential dumping tool. Specifically, it looks for files ending with '.kirbi' (Kerberos tickets) or named 'mimilsa.log' (related to MemSSP). This activity often indicates an attempt to steal Kerberos credentials or other sensitive authentication information.
Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to the client
Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.
Page 6 of 6