Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
205 detections
Filters
Last updated
All Time
Detection languages
68
67
22
18
14
Contributors
52
38
35
20
15
Categories
152
100
51
38
15
Platforms
200
8
2
1
Products / Services
132
92
79
27
12
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
2
1
1
1
1
IDS Classtypes
2
1
IDS Protocols
3
2
This analytic identifies an unusual number of Kerberos service ticket requests (Event 4769) from a single host, which can indicate a Kerberoasting attack. It calculates the standard deviation of unique service requests per user and source, using the 3-sigma rule to detect anomalies. Kerberoasting allows adversaries to obtain and crack service tickets offline, potentially leading to privileged access and escalation within an Active Directory environment.
This analytic detects the execution of the `Get-DomainSPNTicket` commandlet, which is part of the PowerView tool, by monitoring PowerShell Script Block Logging (EventCode=4104). This commandlet is used to request Kerberos service tickets for specified Service Principal Names (SPNs). Detecting this activity is critical because it can indicate attempts to perform Kerberoasting, a technique where attackers extract SPN account passwords for offline cracking. If this activity is confirmed to be malicious, it could lead to unauthorized access to sensitive accounts, potentially resulting in privilege escalation and further compromise of the network.
Detects the potential use of Rubeus by identifying the registration of a new trusted logon process. This activity is often associated with Kerberos-related attacks, where Rubeus is used to manipulate Kerberos tickets or processes for privilege escalation or lateral movement.
Detects potential use of Rubeus via registered new trusted logon process
Detects Kerberos Ticket-Granting Service (TGS) requests that utilize RC4 encryption. This is often indicative of Kerberoasting attacks, where adversaries request service tickets for Service Principal Names (SPNs) and then attempt to crack the RC4-encrypted hash offline to obtain plaintext credentials. The rule specifically excludes requests from computer accounts (service accounts ending with '$') to reduce false positives.
Detects when a user account's User Account Control (UAC) flags are modified to enable weak encryption (DES) or disable Kerberos pre-authentication. This configuration can make the account vulnerable to Kerberoasting attacks, where an attacker can request a service ticket for the user and then offline crack the NTLM hash of the user's password if DES encryption is allowed, or if pre-authentication is disabled.
This rule detects potential exploitation attempts of CVE-2021-42287, a vulnerability related to Active Directory's SAM Account Name Spoofing. The exploit involves an attacker creating a computer object with known credentials, then clearing its ServicePrincipalName attribute. This manipulation grants the attacker additional permissions on the object, enabling further changes. The detection specifically looks for Event IDs 16990 (Object class and UserAccountControl validation failure) and 16991 (SAM Account Name validation failure) from the Microsoft-Windows-Directory-Services-SAM provider, which indicate issues during the creation or modification of Active Directory objects that are characteristic of this attack.
This rule detects the use of `System.IdentityModel.Tokens.KerberosRequestorSecurityToken` within PowerShell script blocks. This specific class is used to request Kerberos service tickets (TGS) for a given Service Principal Name (SPN). This behavior is commonly observed in Kerberoasting attacks (T1558.003) where an attacker requests service tickets to crack their hashes offline, or in some cases, during the initial stages of a silver ticket attack (T1558.002) to gather SPNs. A successful execution of such a script would typically output the SPNs for the targeted endpoint.
Detects service ticket requests using the weak RC4 encryption type (0x17) for Kerberos, which is often abused in Kerberoasting attacks. The rule specifically looks for Event ID 4769 (A Kerberos service ticket was granted) where the TicketOptions indicate a forwardable and renewable ticket, and the TicketEncryptionType is RC4. It attempts to reduce false positives by excluding service names ending with a dollar sign, which are typically machine accounts.
Detects the execution of 'setspn.exe' with the query flag ('-q' or '/q'), which is commonly used by attackers to enumerate Service Principal Names (SPNs) as a precursor to Kerberoasting attacks. This activity can help identify potential attempts to discover service accounts with weak passwords that can be cracked offline.
Detects the creation of specific files commonly associated with Mimikatz, a credential dumping tool. Specifically, it looks for files ending with '.kirbi' (Kerberos tickets) or named 'mimilsa.log' (related to MemSSP). This activity often indicates an attempt to steal Kerberos credentials or other sensitive authentication information.
Detects command-line arguments that are characteristic of Cobalt Strike modules or commands, which may indicate an operator error where these commands are accidentally typed into a command prompt instead of the Cobalt Strike console. This rule specifically looks for common 'Invoke-' PowerShell module names and other Cobalt Strike related keywords executed via 'cmd.exe'.
Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting
Detects the use of KrbRelay, a Kerberos relaying tool
Detects service principal name (SPN) enumeration used for Kerberoasting
Detects service ticket requests using RC4 encryption type
Page 10 of 10