Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
827 detections
Filters
Last updated
All Time
Detection languages
357
171
85
78
49
Contributors
249
169
139
40
32
Categories
329
229
129
111
108
Platforms
754
61
35
15
14
Products / Services
10,680
9,761
6,694
4,418
3,744
827
MITRE Techniques
236
232
203
189
94
CVEs
10
4
3
3
3
IDS Classtypes
8
7
3
2
1
IDS Protocols
10
4
3
3
2
This rule detects multiple attempts by a user account to perform a Directory Synchronization (DirSync) operation, which is a common indicator of a DCSync attack. The rule specifically looks for Event ID 4662 with properties containing 'DS-DirSync' or '131072', filters for user accounts, excludes known service accounts, and triggers if there are 5 or more attempts from the same account and computer.
This rule detects potential Kerberos Constrained Delegation attacks by monitoring Security Event ID 4769 (A Kerberos service ticket was requested) for tickets with the '0x80000000' option, which indicates a forwardable ticket. The rule then aggregates these events by target username, client address, and IP address, flagging instances where 8 or more such tickets are requested, which could indicate an attempt to abuse constrained delegation.
This rule detects potential Golden Ticket attacks by looking for multiple successful Kerberos authentication events (EventID 4624) with LogonType 3 (network logon) and a specific TicketEncryptionType (0x17), originating from the same IP address and targeting the same user, within a short timeframe and with a long ticket lifetime. A Golden Ticket attack involves an adversary forging Kerberos Ticket Granting Tickets (TGTs) to gain unauthorized access to resources.
Detects high volumes of network connections directed at Domain Controller RPC and authentication ports from a single source. This may indicate reachability testing, scanning, or exploitation attempts associated with CVE-2026-41089 (Netlogon RCE).
Detects Kerberoasting attack via high-volume Kerberos TGS requests
This rule detects attempts to copy the Active Directory Certificate Services (ADCS) certificate database for offline forgery. Specifically, it looks for SMB traffic to a server on port 445 (SMB) containing the string "certnew.cer" (case-insensitive) in the content, indicating a file transfer of a newly issued certificate. This activity is often associated with credential access techniques, where an attacker might exfiltrate certificate data to forge credentials.
This rule detects attempts to abuse Active Directory Certificate Services (AD CS) by requesting certificates through the /certsrv/ interface. Specifically, it looks for HTTP requests containing both '/certsrv/' and 'request' in the URI, indicating a certificate enrollment request. The thresholding mechanism (5 requests from the same source within 60 seconds) aims to reduce false positives and highlight potentially automated or repeated attempts to exploit AD CS.
This rule detects attempts to perform SID History Injection via DCSync Replication. Specifically, it looks for TCP traffic on port 445 (SMB) directed to the home network, containing the string "DsAddSidHistory" case-insensitively. This activity is indicative of an attacker attempting to add a Security Identifier (SID) from another account to a target account's SIDHistory attribute, often as part of a privilege escalation technique like DCSync attacks, to gain unauthorized access or maintain persistence within an Active Directory environment.
This rule detects changes to the domain password policy by monitoring Windows Security Event ID 4739. It summarizes these events by the user who made the change and the time, providing an hourly count of policy modifications. This can help identify unauthorized or suspicious alterations to critical security policies.
This rule detects changes to the domain password policy by monitoring Windows Security Event ID 4739. It summarizes these events by the user who made the change and the time, providing an hourly count of policy modifications. This can help identify unauthorized or suspicious alterations to critical security policies.
This rule detects and summarizes changes to domain groups (creation, deletion, or modification) by a specific user. It counts the number of such changes per user per hour, which can be indicative of administrative activity or potential malicious account manipulation.
This rule detects potential brute force attacks against Active Directory accounts by identifying multiple failed login attempts (EventID 4625) from the same IP address to the same account within a short time frame (10 failed attempts within 10 minutes).
This rule detects multiple unauthorized access attempts (5 or more within an hour) to sensitive Active Directory objects such as 'Admin', 'krbtgt', or 'Domain Admins'. It leverages Windows Security Event ID 4662, which indicates an operation was performed on an object, and filters for specific sensitive object names. The rule then groups these attempts by object, IP address, and user, alerting when a threshold of attempts is met.
This rule detects potential Kerberoasting attacks by identifying a high number of Kerberos Ticket-Granting Service (TGS) requests (EventID 4769) for Service Principal Names (SPNs) that are encrypted with RC4 (indicated by TicketOptions containing '0x40810000'). A threshold of 15 or more TGS requests from a single IP address for a target user is used to flag suspicious activity.
This rule detects network traffic indicative of BloodHound's domain trust collection activity over SMB. Specifically, it looks for TCP traffic on port 445 (SMB) directed to the home network, containing the strings "(objectClass=trustedDomain)" and "SYSVOL" (case-insensitive). This combination suggests an attacker is querying Active Directory for trusted domain objects and potentially enumerating the SYSVOL share, which are common steps in BloodHound's reconnaissance phase to map out trust relationships within a domain.
This rule detects attempts to harvest Group Policy Preferences (GPP) credentials from the SYSVOL share over SMB. It specifically looks for network traffic on port 445 (SMB) containing the strings "SYSVOL" and "Groups.xml" in a case-insensitive manner, indicating a potential attempt to access the file where GPP credentials might be stored.
This rule detects potential abuse of Group Policy Objects (GPOs) by identifying multiple changes (3 or more) to GPO-related objects within a short timeframe. It specifically looks for Event ID 5136 (Directory Service Changes) where the ObjectClass is either 'groupPolicyContainer' or 'gPCFileSysPath'. This could indicate an adversary modifying GPOs to achieve persistence, privilege escalation, or other malicious objectives.
This rule detects when a batch script (.bat) is dropped onto a network share, specifically targeting the NETLOGON share, which is often used for logon scripts. This activity can be indicative of an attacker attempting to establish persistence or execute malicious code on systems that process logon scripts from this share. The rule triggers if three such events are observed from the same source within 60 seconds.
This rule detects attempts to query the domain password policy over SMB by looking for the 'NetUserModalsGet' content within TCP traffic on port 445. This activity is often associated with reconnaissance or discovery phases by attackers to understand password complexity requirements.
This rule detects an AS-REP Roasting attack where pre-authentication is not required. It specifically looks for UDP traffic on port 88 (Kerberos) containing specific byte sequences associated with this attack technique. The rule uses a threshold to prevent excessive alerts from a single source.
This rule detects when a single user makes multiple changes to security groups within a short timeframe (binned hourly). Specifically, it looks for Event IDs 4752 (A security-enabled global group was changed), 4753 (A security-enabled local group was changed), or 4754 (A security-enabled universal group was changed). This could indicate an attempt to manipulate group memberships for privilege escalation or lateral movement.
Page 28 of 40