Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6 detections
Filters
Last updated
All Time
Detection languages
3
2
1
Contributors
2
1
1
1
1
Categories
2
2
1
1
1
Platforms
3
2
1
Products / Services
2
1
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
This rule detects the execution of known Remote Monitoring and Management (RMM) tools across the environment. RMM tools are frequently used by IT administrators for legitimate support, but are also commonly abused by threat actors to establish persistence and gain remote access to systems. The rule tracks the first instance of these processes appearing on any device within a 30-day window.
Detects PowerShell script block execution containing patterns associated with network discovery, specifically splitting IP strings and calculating /24 subnets, often indicative of host or network reconnaissance.
Detects unauthorized access attempts to sensitive SD-WAN control plane endpoints via REST API or the presence of suspicious 'evil_tenant.csv' artifacts, which may indicate reconnaissance or staging activities.
Kerberos Realm Trust Discovery
Suricata
This rule detects Kerberos Realm Trust Discovery attempts by looking for specific byte patterns in TCP traffic destined for port 88 (Kerberos). The rule triggers if the byte sequence "6b 82" is found within the first 2 bytes of the payload. A threshold is applied to prevent excessive alerts, triggering if 10 such events occur from the same source within 30 seconds.
This rule detects attempts to enumerate domain trust relationships using LDAP queries. Specifically, it looks for TCP traffic on port 389 (LDAP) containing the string "(objectClass=trustedDomain)" in the server-bound flow. This string is commonly used in LDAP queries to discover trusted domains within an Active Directory environment, which can be a reconnaissance step for attackers.
KQL Query from file: Honeypot Threat Intelligence (TI) Data
