Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
116 detections
Filters
Last updated
All Time
Detection languages
43
26
19
12
6
Contributors
26
22
11
11
10
Categories
74
59
25
19
11
Platforms
106
7
1
1
1
Products / Services
51
51
26
21
10
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
5
IDS Classtypes
4
1
1
IDS Protocols
3
2
1
This analytic detects executables running from public or temporary locations that are communicating over Windows domain authentication ports/protocols such as LDAP (389), LDAPS (636), and Kerberos (88). It leverages network traffic data to identify processes originating from user-controlled directories. This activity is significant because legitimate applications rarely run from these locations and attempt domain authentication, making it a potential indicator of compromise. If confirmed malicious, attackers could leverage this to access domain resources, potentially leading to further exploitation and lateral movement within the network.
Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments. Certipy can be used to enumerate Active Directory Certificate Services (AD CS) for misconfigurations, request certificates, and perform various attacks such as forging authentication certificates (ESC1, ESC2, ESC3, ESC4, ESC6, ESC7, ESC8, ESC9, ESC10). The rule looks for the executable name, original file name, description containing 'Certipy', or specific command-line arguments and flags commonly used by Certipy.
Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.
Detects the creation or update of Active Directory Certificate Services (AD CS) certificate templates that are configured with risky Extended Key Usages (EKUs) and allow the enrollee to supply the subject. This combination can be exploited for privilege escalation and credential access, as described in the 'Certified Pre-Owned' whitepaper, by allowing an attacker to request certificates with arbitrary subject names, potentially impersonating privileged accounts.
This rule detects the creation or update of Active Directory Certificate Services (AD CS) certificate templates that include the 'CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT' flag. This flag allows a user to specify the subject name in a certificate request, which can be abused for privilege escalation or credential access, particularly in scenarios involving misconfigured AD CS environments as described in the 'Certified Pre-Owned' research.
Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store. This activity can be indicative of an adversary attempting to steal authentication certificates for various malicious purposes, including lateral movement, persistence, or privilege escalation.
Detects the execution of Certify, a tool used for Active Directory certificate abuse, by identifying its executable name, original file name, description in PE metadata, and specific command-line arguments related to certificate operations such as listing Certificate Authorities (CAs), finding vulnerable templates, requesting, and downloading certificates.
This rule detects when an application acquires a certificate private key. This event (EventID 70 in the CAPI2 Operational log) indicates that a private key associated with a certificate has been accessed or exported. This activity can be indicative of an adversary attempting to steal or gain access to authentication certificates for various malicious purposes, such as impersonation or persistence.
Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments.
Detects when an application acquires a certificate private key
Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store.
Page 6 of 6