Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
123 detections
Filters
Last updated
All Time
Detection languages
42
41
26
7
4
Contributors
40
34
15
7
5
Categories
41
34
32
19
19
Platforms
74
31
9
8
4
Products / Services
10,680
9,761
6,694
4,418
3,744
MITRE Techniques
47
29
29
28
26
CVEs
2
2
1
1
1
IDS Classtypes
11
10
5
IDS Protocols
26
Detection rule monitoring for indicators of compromise related to SolarWinds Serv-U, including anomalous Content-Encoding headers, unexpected child process execution, large file staging indicative of data exfiltration (Cl0p-style), outbound exfiltration, SQL injection artifacts, and unauthorized LDAP/Active Directory object enumeration by the Serv-U process.
Detects modification of domain trust relationships via LDAP for privilege escalation
This rule detects network connections to port 389 (LDAP) that contain specific keywords related to Active Directory trust relationships. This could indicate an adversary attempting to discover trust details within an Active Directory environment.
Detection rule monitoring for indicators of compromise related to SolarWinds Serv-U, including anomalous Content-Encoding headers, unexpected child process execution, large file staging indicative of data exfiltration (Cl0p-style), outbound exfiltration, SQL injection artifacts, and unauthorized LDAP/Active Directory object enumeration by the Serv-U process.
Targets anomalous Netlogon or CLDAP traffic followed by LSASS termination or domain-controller restart indicators. The UDM rule retains principal and target context for correlation.
This rule detects high-volume connection requests to LDAP services (default ports 389, 636, 3268, 3269). A high number of connections from a single source to a destination within a short time window may indicate automated reconnaissance, LDAP enumeration, or brute-force attempts against domain services.
Lateral Movement via VPN
Cortex XDR
This rule detects post-VPN activity indicative of discovery or lateral movement targeting directory services. It specifically looks for commands associated with LDAP, Kerberos, SMB, or WinRM activity to multiple internal systems, often seen after an initial VPN compromise. The rule focuses on processes like PowerShell, cmd, net, nltest, adfind, ldapsearch, wmic, and winrs executing commands related to network enumeration and directory service interaction.
Detects bulk domain group membership enumeration via LDAP
Targets anomalous Netlogon or CLDAP traffic followed by LSASS termination or domain-controller restart indicators. The UDM rule retains principal and target context for correlation.
Detects LDAP queries enumerating user accounts in Active Directory
Detects enumeration of domain trusts via LDAP queries
Detects enabling of reversible password encryption in Active Directory
Detects creation of new domain accounts via LDAP for persistent access
Detects password spraying attacks targeting LDAP for domain accounts
This rule detects a DCSync attack by looking for the "DsGetNCChanges" string in TCP traffic on port 389 (LDAP). DCSync is a technique used by attackers to simulate a domain controller and request directory replication, allowing them to extract password hashes and other sensitive information from Active Directory.
This rule detects potential network scanning activity targeting LDAP services (port 389) for user session information. It specifically looks for LDAP queries containing "(objectClass=user)" and "lastLogon" within the established TCP flow to the server. A threshold of 5 such queries from the same source within 30 seconds triggers the alert, indicating a possible attempt to enumerate active user sessions.
This rule detects attempts to enumerate domain trusts by querying LDAP for objects with the 'objectClass=trustedDomain' attribute. This activity is often performed by attackers during the discovery phase to map out the network topology and identify potential lateral movement paths. The rule specifically looks for TCP traffic to port 389 (LDAP) on the home network, containing the specified LDAP filter, and uses a threshold to prevent excessive alerts from legitimate, but frequent, queries.
Detects LDAP-based modification of authentication configurations for credential theft
Detects LDAP account modifications used to maintain persistent access
This rule detects a replication request to a Domain Controller (DC) containing the string "DsGetNCChanges" over TCP port 389 (LDAP). This specific string is associated with Active Directory replication. The rule is designed to identify potential rogue Domain Controllers attempting to replicate with legitimate DCs, which could indicate an attacker trying to establish a malicious DC for credential harvesting or other attacks. A threshold of 3 occurrences within 60 seconds from the same source IP is set to reduce false positives.
This rule detects when the 'sIDHistory' attribute is added to a domain account. This is a common technique used in privilege escalation, particularly in Active Directory environments, where an attacker adds the SID of a highly privileged account (like a Domain Admin) to a compromised account's sIDHistory. This grants the compromised account the privileges of the added SID without changing its primary SID.
Page 2 of 6