Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
13 detections
Filters
Last updated
All Time
Detection languages
7
2
2
1
1
Contributors
4
4
2
2
1
Categories
11
4
3
3
2
Platforms
8
2
2
1
1
Products / Services
4
3
3
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
2
IDS Protocols
1
1
This rule identifies suspicious Kerberos activity indicative of Golden or Silver Ticket attacks. It monitors for service ticket (4769) requests that occur without a preceding TGT request (4768) within a specified window, detects RC4 encryption downgrades on Kerberos requests in environments expected to use AES, and identifies tickets containing non-standard TicketOptions commonly associated with automated forgery tools like Mimikatz.
Detects the use of Mimikatz-style command-line arguments to manipulate Kerberos tickets, including ticket requests, purges, and golden/silver ticket creation attempts.
Detects the execution of Rubeus, a common security tool used for Kerberos-based attacks including Golden/Silver Ticket forgery, AS-REP roasting, Kerberoasting, and ticket harvesting. The rule monitors command-line indicators associated with known Rubeus arguments.
Detects the execution of the Rubeus tool, a C# toolkit used for interacting with the Kerberos protocol. The rule specifically monitors command-line arguments and process names associated with common Kerberos exploitation tasks such as Kerberoasting, Golden/Silver Ticket forging, and ticket manipulation.
Detects Golden Ticket attack using forged Kerberos TGT with krbtgt hash
Detects Silver Ticket attack using forged Kerberos service tickets
This rule detects the use of a Silver Ticket for SMB service authentication. A Silver Ticket is a forged Kerberos service ticket that allows an attacker to authenticate to a specific service (like SMB) on a specific server without needing to interact with the Domain Controller. The rule looks for TCP traffic on port 445 (SMB) containing both 'NTLMSSP' and 'KRB5' content, indicating a Kerberos authentication attempt that might be a Silver Ticket. A threshold is applied to prevent excessive alerts.
This rule detects a Silver Ticket attack, specifically looking for forged Kerberos service tickets. It inspects UDP traffic on port 88 (Kerberos) for specific byte sequences indicative of a forged ticket. The content '|6b|' at depth 1 and '|a0 03 02 01 05|' are specific patterns associated with the structure of a Kerberos ticket, which when combined, suggest a malicious attempt to authenticate to a service without proper credentials.
Detects the execution of the hacktool Rubeus using specific command line flags within PowerShell script block logs. This rule identifies various Kerberos-related attacks such as AS-REPRoasting, Kerberoasting, Pass-the-Ticket, Golden Ticket, and Silver Ticket attacks, as well as credential harvesting and dumping.
KQL Query from file: Hunting Malicious Copilot Agent
This query helps hunting for BEC - File sharing tactics - OneDrive or SharePoint
This query looks for users performing file deletion activities. Spikes in file deletion observed from risky sign-in sessions are flagged here.
This applies to SharePoint and OneDrive users.
Audit event and Cloud application identifier references.
Reference - https://learn.microsoft.com/microsoft-365/compliance/audit-log-activities?view=o365-worldwide
Reference - https://learn.microsoft.com/azure/sentinel/entities-reference#cloud-application-identifiers
This applies to SharePoint and OneDrive users.
Audit event and Cloud application identifier references.
Reference - https://learn.microsoft.com/microsoft-365/compliance/audit-log-activities?view=o365-worldwide
Reference - https://learn.microsoft.com/azure/sentinel/entities-reference#cloud-application-identifiers
This rule detects the use of `System.IdentityModel.Tokens.KerberosRequestorSecurityToken` within PowerShell script blocks. This specific class is used to request Kerberos service tickets (TGS) for a given Service Principal Name (SPN). This behavior is commonly observed in Kerberoasting attacks (T1558.003) where an attacker requests service tickets to crack their hashes offline, or in some cases, during the initial stages of a silver ticket attack (T1558.002) to gather SPNs. A successful execution of such a script would typically output the SPNs for the targeted endpoint.