Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
827 detections
Filters
Last updated
All Time
Detection languages
357
171
85
78
49
Contributors
249
169
139
40
32
Categories
329
229
129
111
108
Platforms
754
61
35
15
14
Products / Services
10,680
9,761
6,694
4,418
3,744
827
MITRE Techniques
236
232
203
189
94
CVEs
10
4
3
3
3
IDS Classtypes
8
7
3
2
1
IDS Protocols
10
4
3
3
2
This rule detects a specific type of Kerberos AS-REQ (Authentication Service Request) that lacks pre-authentication, which is characteristic of a 'Golden Ticket' attack (ATT&CK T1558.001). The rule specifically looks for UDP traffic on port 88 (Kerberos default port) to the home network, containing the byte sequences '|30|' and '|a1 03 02 01 05|'. These content checks are indicative of the structure of a Kerberos AS-REQ packet without the expected pre-authentication data.
This rule detects potential Kerberoasting attacks by identifying a high number of Kerberos Ticket-Granting Service (TGS) requests (EventID 4769) for Service Principal Names (SPNs) that are encrypted with RC4 (indicated by TicketOptions containing '0x40810000'). A threshold of 15 or more TGS requests from a single IP address for a target user is used to flag suspicious activity.
This rule detects potential abuse of Group Policy Objects (GPOs) by identifying multiple changes (3 or more) to GPO-related objects within a short timeframe. It specifically looks for Event ID 5136 (Directory Service Changes) where the ObjectClass is either 'groupPolicyContainer' or 'gPCFileSysPath'. This could indicate an adversary modifying GPOs to achieve persistence, privilege escalation, or other malicious objectives.
This rule detects suspicious changes to account delegation settings by monitoring Security Event ID 5136 for modifications to the 'msDS-AllowedToDelegateTo' attribute. It specifically looks for instances where an account's delegation settings are changed two or more times within an hour, which could indicate an adversary attempting to establish persistence or elevate privileges through constrained delegation.
This rule detects potential brute force attacks against Active Directory accounts by identifying multiple failed login attempts (EventID 4625) from the same IP address to the same account within a short time frame (10 failed attempts within 10 minutes).
This rule detects the deployment of a network logon script named 'logon.bat' within the 'SYSVOL' share over SMB (port 445). This activity is often associated with persistence techniques where an attacker modifies or creates logon scripts to execute malicious code when users log in to the domain.
This rule detects network traffic on TCP port 445 (SMB) containing the string 'lsasrv.dll' in a case-insensitive manner, indicating a potential attempt to modify the Domain Controller's authentication package. This activity is often associated with persistence techniques where an attacker modifies or replaces legitimate authentication packages to maintain access or elevate privileges.
This rule detects an anomaly in Kerberos authentication attempts by monitoring TCP traffic to port 88 (Kerberos). It triggers an alert if a source IP address attempts Kerberos authentication 30 or more times within a 10-second window, indicating a potential brute-force or rapid authentication attempt against a domain account.
This rule detects attempts to enumerate the 'Domain Admins' group over SMB (Server Message Block) using the 'NetGroupGetUsers' function. This activity is often associated with reconnaissance by attackers trying to identify high-privilege accounts within a Windows domain.
This rule detects unauthorized Kerberos service ticket requests directed at a Domain Controller (DC). It specifically looks for TCP traffic to port 88 (Kerberos) on the home network, with a content match for the byte sequence '|6b|' at the beginning of the payload. A threshold of 50 requests within 10 seconds from the same source IP triggers the alert, indicating a potential brute-force or enumeration attempt against Kerberos services.
This rule detects and summarizes changes to domain groups (creation, deletion, or modification) by a specific user. It counts the number of such changes per user per hour, which can be indicative of administrative activity or potential malicious account manipulation.
This rule detects potential Kerberos Constrained Delegation attacks by monitoring Security Event ID 4769 (A Kerberos service ticket was requested) for tickets with the '0x80000000' option, which indicates a forwardable ticket. The rule then aggregates these events by target username, client address, and IP address, flagging instances where 8 or more such tickets are requested, which could indicate an attempt to abuse constrained delegation.
This rule detects an anomaly in Kerberos Ticket Granting Ticket (TGT) requests. Specifically, it triggers an alert if more than 50 UDP Kerberos TGT requests are observed from a single source IP address within a 10-second window to the home network on port 88. This behavior could indicate an attempt to enumerate valid user accounts or perform credential stuffing/brute-force attacks against the Kerberos authentication system, potentially as part of a privilege escalation attempt (ATT&CK T1134).
Detects modifications to the msDS-KeyCredentialLink attribute on Delegated Managed Service Account (dMSA) objects, indicating a potential Shadow Credential (X.509 certificate) planting. This allows an attacker to bypass managed password rotation and maintain permanent PKINIT access, as seen in the dMSA Ouroboros attack chain. The rule also monitors Event 4768 (PKINIT TGT requests with pre-authentication type 17) and Event 4662 (S4U2Self Object Access) for dMSA objects, which are key indicators of this attack.
Detects modifications to the msDS-GroupMSAMembership attribute on Delegated Managed Service Account (dMSA) objects. Attackers may write the dMSA's own SID into this attribute to self-authorize credential extraction, establishing a self-sustaining Ouroboros loop.
Detects the creation or modification of a ScheduledTasks.xml file within the SYSVOL directory, indicative of automated task deployment via Group Policy Preferences (GPP) commonly abused by adversaries. This activity can be used for persistence, privilege escalation, or lateral movement.
Detects the creation of a new computer account (Event ID 4741) where the creating user is a known service account used by FortiGate appliances. Attackers who compromise FortiGate devices can steal embedded LDAP credentials and use them to join rogue workstations to the domain, leveraging the `mS-DS-MachineAccountQuota` attribute.
This rule detects attempts to manipulate user or service principal names (SPN/UPN) in Active Directory by adding non-ASCII or zero-width characters. Such modifications can be used by adversaries for obfuscation, to bypass detection mechanisms, or to create stealthy persistence. The rule specifically looks for Event IDs 4738 (User Account Changed) and 5136 (Directory Service Object Modified) where the 'servicePrincipalName' or 'userPrincipalName' attributes contain characters outside the standard ASCII range or zero-width characters like U+200B, U+200C, U+200D.
Detects a FortiGate configuration file download followed by the creation of a new computer account in Active Directory by the 'fortidcagent' service account within a short time window. This pattern may indicate an attacker has compromised a FortiGate appliance, extracted credentials from the configuration, and is now using them to join a rogue device to the domain for lateral movement.
This rule detects attempts to access specific Active Directory object types (identified by their GUIDs) with an access mask of 0x100 (which typically indicates 'Write Property' access). It filters out common service accounts and system accounts to reduce noise.
This rule detects inbound network connections to Active Directory Web Services (ADWS) on port 9389, followed by either LDAP query events (Event ID 1644) or operations on Active Directory objects (Event ID 4662) originating from the same device. This combination of events can indicate reconnaissance or malicious activity targeting Active Directory, such as attempts to enumerate accounts or groups, or to modify AD objects.
Page 29 of 40