Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
827 detections
Filters
Last updated
All Time
Detection languages
357
171
85
78
49
Contributors
249
169
139
40
32
Categories
329
229
129
111
108
Platforms
754
61
35
15
14
Products / Services
10,680
9,761
6,694
4,418
3,744
827
MITRE Techniques
236
232
203
189
94
CVEs
10
4
3
3
3
IDS Classtypes
8
7
3
2
1
IDS Protocols
10
4
3
3
2
Detects Kerberos Ticket Granting Service (TGS) requests using RC4 encryption (0x17), which is a common indicator of Kerberoasting. The rule excludes common non-user account ticket requests (machine accounts and krbtgt) to reduce noise, focusing on potential service account targeting.
Detects Kerberos Ticket Granting Service (TGS) requests using RC4 encryption (0x17), which is a common indicator of Kerberoasting. The rule excludes common non-user account ticket requests (machine accounts and krbtgt) to reduce noise, focusing on potential service account targeting.
Detects Kerberos Authentication Service Requests (AS-REQ) resulting in a ticket granting ticket (TGT) where the TicketOptions field is set to '0x40810010'. This specific combination is often associated with the behavior of tools performing Kerberoasting or specific types of ticket-based attacks, as it indicates a TGT request that may bypass standard pre-authentication or follow non-standard flow patterns.
Detects modifications to a computer account (Event ID 4742) that involve the addition or modification of Service Principal Names (SPNs) containing sensitive strings such as 'GC/' (Global Catalog), 'DRS' (Directory Replication Service), or specific GUIDs. These activities are often associated with techniques to facilitate Kerberoasting, domain trust exploitation, or unauthorized service manipulation.
Detects modifications to Windows domain trusts (Event ID 4706) or changes to domain security policies (Event ID 4716). These events are critical as they can indicate attempts to modify domain-level trust relationships or alter auditing and security settings.
Detects Kerberos Authentication Service Requests (AS-REQ) resulting in a ticket granting ticket (TGT) where the TicketOptions field is set to '0x40810010'. This specific combination is often associated with the behavior of tools performing Kerberoasting or specific types of ticket-based attacks, as it indicates a TGT request that may bypass standard pre-authentication or follow non-standard flow patterns.
Detects modifications to the AdminSDHolder object in Active Directory via Windows Security Event ID 5136. The AdminSDHolder object maintains the security permissions for all objects protected by the AdminSDHolder process. Adversaries often modify this object to establish persistence and gain unauthorized access to highly privileged accounts within the domain.
Detects the deletion of directory service objects such as users, groups, organizational units, computers, or trusted domains. This is identified via Windows Security Event ID 5141, which tracks when a directory object is deleted.
Detects modifications to domain trust relationships, such as the creation of a new trust, removal of an existing trust, or changes to trusted domain information. Such events are monitored as they can indicate an adversary attempting to elevate privileges or establish persistence across a forest or multi-domain environment.
This rule detects the configuration of 'Trusted for Delegation' on a computer or user account, followed by a modification to the Active Directory nTDSDSA object on the same host. This combination is a classic indicator of setting up an account for Kerberos delegation attacks, often related to the creation of rogue domain controllers or setting up pivot points for lateral movement.
Detects Kerberos AS-REQ events (Event ID 4768) where pre-authentication is not used (PreAuthType 0). This is a common indicator of attempts to perform Kerberoasting or AS-REP roasting, as attackers may attempt to request tickets for accounts without requiring the initial pre-authentication step.
Detects changes to the attributes of the AdminSDHolder object in Active Directory. The AdminSDHolder object is a template used by the Active Directory security descriptor propagator (SDProp) to enforce permissions on protected administrative groups. Modification of this object is a highly suspicious activity that can be used to establish persistence or grant excessive privileges by poisoning the security descriptors of all protected objects within the domain.
Detects AS-REQ requests for accounts where Kerberos pre-authentication is disabled (PreAuthType 0) and insecure ticket encryption types (0x17, 0x18, 0x1) are used. This behavior is indicative of an AS-REP Roasting attack, where an adversary attempts to obtain the encrypted AS-REP response for an account to perform offline brute-force password cracking.
This rule detects potential Kerberoasting activity by monitoring Windows Event ID 4769 (Kerberos service ticket request). It identifies excessive requests for service tickets using RC4 encryption (0x17) by a single account within a 10-minute window, excluding common service accounts and krbtgt requests.
This rule detects modifications to Group Policy Objects (GPOs) that involve sensitive attributes such as logon scripts, startup/shutdown scripts, or file system paths, particularly when performed by service accounts or non-administrator users. This activity is a common indicator of persistence mechanisms or lateral movement via GPO abuse.
Detects sensitive Active Directory replication operations (DS-Replication-Get-Changes or DS-Replication-Get-Changes-All) initiated by accounts other than standard domain controllers. This behavior is a common indicator of DCSync attacks, where an adversary mimics a domain controller to request sensitive Active Directory data, such as password hashes, from a legitimate domain controller.
Detects potential DCSync attacks by monitoring for Windows Event ID 4662 (Object Access) related to Directory Replication (DS-Replication-Get-Changes or DS-Replication-Get-Changes-All GUIDs) originating from non-domain controller accounts. This identifies unauthorized attempts to replicate Active Directory password data.
This rule detects unauthorized access attempts to Active Directory Directory Replication Services using Event ID 4662. It specifically monitors for the access mask 0x100 (Control Access) against the Domain Replication Service GUIDs, which are often indicative of techniques like DCSync used to harvest credentials or replicate the NTDS.dit database.
This rule detects indicators of the DCShadow attack technique by monitoring for the creation of nTDSDSA objects (which define domain controllers) or the addition of suspicious Service Principal Names (SPNs) often used in DCShadow simulations (GC/ or E3514235-4B06) to computer accounts. These indicators suggest an attacker is attempting to register a rogue Domain Controller to manipulate Active Directory data.
This rule monitors for two distinct behaviors: direct modification of Group Policy Object (GPO) containers within Active Directory and suspicious execution of GPO management tools (gpupdate.exe or gpedit.msc) across multiple hosts in a short timeframe. AD modification events are flagged as critical, while elevated tool execution patterns are flagged as high or medium risk based on host prevalence.
Detects when a user account is added to a security-enabled global, local, or universal group in Active Directory. This behavior is captured by monitoring Security Events 4728 (global group), 4732 (local group), and 4756 (universal group). The rule flags actions performed by user accounts (excluding system accounts) and aggregates them by the source account performing the modification.
Page 23 of 40