Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
32 detections
Filters
Last updated
All Time
Detection languages
20
8
2
2
Contributors
11
9
3
3
2
Categories
16
7
4
4
4
Platforms
29
2
1
1
Products / Services
6
4
4
3
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
2
IDS Protocols
1
1
Detects the execution of tools and commands commonly used to enumerate Group Policy Objects (GPOs) within an environment, such as gpresult.exe with specific flags, PowerShell scripts querying GPO modules, or ldifde.exe checking group policy containers.
Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine
SYSVOL / NETLOGON Enumeration
Cortex XDR
Every authenticated principal in the domain can read SYSVOL, and SYSVOL routinely stores logon scripts, scheduled-task XML, and GPP files that contain plaintext or reversibly-encrypted credentials. Adversaries recursively enumerate SYSVOL to harvest these — either grepping file contents (Select-String 'password') or matching file names (dir *password*). This rule detects the read-access footprint of that enumeration on the DC itself, independent of the tool or command line used, by counting distinct SYSVOL paths accessed by a single non-machine account in a short window. Default threshold is 100, change to a high volume for your environment
SYSVOL / NETLOGON Enumeration
Cortex XDR
Every authenticated principal in the domain can read SYSVOL, and SYSVOL routinely stores logon scripts, scheduled-task XML, and GPP files that contain plaintext or reversibly-encrypted credentials. Adversaries recursively enumerate SYSVOL to harvest these — either grepping file contents (Select-String 'password') or matching file names (dir *password*). This rule detects the read-access footprint of that enumeration on the DC itself, independent of the tool or command line used, by counting distinct SYSVOL paths accessed by a single non-machine account in a short window. Default threshold is 100, change to a high volume for your environment
Detects enumeration of Group Policy Objects through SYSVOL share access
This rule detects attempts to enumerate Group Policy Object (GPO) settings by identifying LDAP queries containing the string "(objectClass=groupPolicyContainer)" over TCP port 389 (LDAP). This activity is often associated with reconnaissance or discovery phases of an attack, where an adversary is trying to understand the domain's GPO structure.
This rule detects attempts to enumerate Group Policy Objects (GPOs) by accessing the SYSVOL share over SMB. It specifically looks for SMB traffic to port 445 containing both 'SYSVOL' and 'GroupPolicy' keywords, indicating an attempt to browse or access GPO-related files. A threshold of 5 such events within 30 seconds from the same source IP triggers the alert, suggesting a potential network scan or reconnaissance activity.
Detects the use of SharpUp, a tool for local privilege escalation
This rule detects attempts to discover Group Policy settings on a Windows system. It identifies the execution of common command-line interpreters (cmd.exe, powershell.exe, wmic.exe, rundll32.exe) followed by specific commands or PowerShell cmdlets used for GPO enumeration. This includes native Windows commands like 'gpresult' and 'secedit', registry queries for policy settings, and PowerShell cmdlets such as 'Get-GPO' and 'Get-GPResultantSetOfPolicy'. Additionally, it looks for LDAP-related commands or patterns ('ldapsearch', 'groupPolicyContainer') that might indicate GPO discovery via directory services. The rule also correlates these process events with network connections to SYSVOL shares or LDAP ports (389, 636) to further confirm GPO-related activity.
This rule detects attempts to discover Group Policy settings on a system. It identifies the execution of common command-line interpreters (cmd.exe, powershell.exe, wmic.exe, rundll32.exe) followed by specific commands or PowerShell cmdlets used for GPO enumeration. This includes native Windows commands like 'gpresult' and 'secedit', registry queries for policy settings, PowerShell cmdlets such as 'Get-GPO' and 'Get-GPResultantSetOfPolicy', and LDAP-related queries for 'groupPolicyContainer'. Additionally, it correlates these process events with network connections to SYSVOL shares or LDAP ports (389, 636) that also contain 'groupPolicyContainer' in the URL, indicating potential GPO access. The rule filters out common system processes to reduce noise.
Detects cases in which a user uses the built-in Windows utility gpresult to display the Resultant Set of Policy (RSoP) information
Detects the execution of SharpUp, a tool used for local privilege escalation. The rule specifically looks for the executable name 'SharpUp.exe' or the description 'SharpUp', combined with command-line arguments indicative of its privilege escalation enumeration capabilities, such as 'HijackablePaths', 'UnquotedServicePath', 'ProcessDLLHijack', 'ModifiableServiceBinaries', 'ModifiableScheduledTask', 'DomainGPPPassword', and 'CachedGPPPassword'.
Detects potential malicious use of LDAP queries associated with Metasploit activity targeting Active Directory. LDAP enumeration can reveal detailed information about users, groups, computers, and other objects within a network that can be exploited by attackers.
Detects the use of SharpUp, a tool for local privilege escalation
Detects the use of SharpUp, a tool for local privilege escalation
Detect use of Get-GPO to get one GPO or all the GPOs in a domain.
Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine
Detects cases in which a user uses the built-in Windows utility gpresult to display the Resultant Set of Policy (RSoP) information
Author: alex verboon @alexverboon.
Blogpost: https://www.verboon.info/2020/09/hunting-for-local-group-membership-changes.
Blogpost: https://www.verboon.info/2020/09/hunting-for-local-group-membership-changes.
Detects cases in which a user uses the built-in Windows utility gpresult to display the Resultant Set of Policy (RSoP) information
Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine
Page 1 of 2