Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
128 detections
Filters
Last updated
All Time
Detection languages
45
44
17
10
5
Contributors
43
25
15
10
9
Categories
54
43
33
27
23
Platforms
105
13
7
3
3
Products / Services
10,660
9,755
6,689
4,418
3,748
MITRE Techniques
56
49
43
35
33
CVEs
3
3
3
1
1
IDS Classtypes
7
3
IDS Protocols
10
Detects NTLM network logons (LogonType 3) where the workstation name does not match the target computer name and is not a machine account. This pattern is commonly associated with lateral movement techniques such as Pass-the-Hash or other credential relay attacks, where an adversary authenticates to a remote system using compromised credentials.
Detects attempts to leverage PowerShell to register a loose-file AppX package from a UNC path. This technique can be used to trigger NTLM coercion via InstallService.exe or achieve SYSTEM DLL load, often associated with the 'UNCanny' coercion method. The rule looks for PowerShell command lines containing 'Add-AppxPackage', '-Register', and a UNC path (\\) along with 'AppxManifest.xml'. Additional suspicious indicators like '-ExecutionPolicy Bypass', 'DiscCoerceProbe', 'poc.ps1', 'Invoke-InstallServiceCoerce.ps1', or '-AttackerHost' increase the suspicious score.
This rule detects potential Pass-the-Hash (PtH) attacks by looking for multiple successful network logons (LogonType 3) using NTLM authentication for the same user from the same IP address. A count of 5 or more such events is considered suspicious.
Detects SMB NTLM relay attacks used for credential capture and lateral movement
This rule detects potential SMB Relay attacks attempting to capture NTLM hashes. It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, where the flow is established and contains both "NTLMSSP" and "NTLMSSP_AUTH" content. A threshold of 3 occurrences within 30 seconds from the same source IP is set to reduce false positives.
This rule detects the use of a Silver Ticket for SMB service authentication. A Silver Ticket is a forged Kerberos service ticket that allows an attacker to authenticate to a specific service (like SMB) on a specific server without needing to interact with the Domain Controller. The rule looks for TCP traffic on port 445 (SMB) containing both 'NTLMSSP' and 'KRB5' content, indicating a Kerberos authentication attempt that might be a Silver Ticket. A threshold is applied to prevent excessive alerts.
This rule detects SMB authentication attempts that might be indicative of a 'Pass-the-Hash' attack (ATT&CK T1550.002). It specifically looks for NTLMSSP (NT LAN Manager Security Support Provider) traffic on TCP port 445 (SMB) where the NTLM authentication message contains a specific sequence of null bytes, which can be characteristic of a hash being passed instead of a cleartext password.
This rule detects network traffic indicative of a domain account being used for lateral movement via SMB. It specifically looks for NTLMSSP authentication within SMB traffic directed to port 445 on the home network, containing the string 'domain' (case-insensitive). A threshold of 10 occurrences within 60 seconds from the same source IP triggers the alert, suggesting a potential brute-force or rapid access attempt.
Detects reuse of alternate authentication materials like tokens or cookies
This rule detects potential Pass-the-Hash (PtH) attacks by looking for multiple successful network logons (LogonType 3) using NTLM authentication for the same user from the same IP address. A count of 5 or more such events is considered suspicious.
This rule detects potential lateral movement attempts using alternate authentication material, specifically NTLMSSP, over SMB (port 445). It triggers an alert if five or more NTLMSSP authentications are observed from a single source IP address to the home network within a 30-second window. This behavior can indicate an attacker attempting to authenticate to multiple systems using stolen credentials or hashes.
Detects command line execution of 'search:' or 'search-ms:' URI handlers utilizing the 'crumb=location:' parameter pointing to a remote UNC path, which forces outbound NTLM authentication. This technique can be used by adversaries to capture NTLM hashes.
This rule detects suspicious NTLM network or remote interactive logon activity. It specifically looks for multiple distinct accounts logging in from the same device and remote IP address within a one-hour window, using NTLM authentication via NtLmSsp or Seclogon processes. This pattern can indicate credential stuffing, NTLM relay attacks, or other forms of credential misuse.
This rule detects potential NTLM Relay attacks over SMB. It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, and within that traffic, it identifies the presence of both the SMB protocol signature ('|FF|SMB') and the NTLMSSP (NTLM Security Support Provider) signature. This combination suggests an attempt to relay NTLM authentication.
SMB Authentication Brute Force
Suricata
This rule detects SMB authentication brute force attempts by looking for multiple NTLMSSP_AUTH messages over port 445 (SMB) from the same source IP within a 30-second window. A threshold of 10 attempts triggers the alert, indicating a potential brute force attack against SMB authentication.
This rule detects suspicious NTLM network or remote interactive logon activity. It specifically looks for multiple distinct accounts logging in from the same device and remote IP address within a one-hour window, using NTLM authentication via NtLmSsp or Seclogon processes. This pattern can indicate credential stuffing, NTLM relay attacks, or other forms of credential misuse.
https://thehackernews.com/2026/04/microsoft-confirms-active-exploitation.html
NTLM Logon
Sigma
Detects logons using NTLM, which could be caused by a legacy source or attackers
This rule detects an unusually high number of NTLM logon attempts (more than 3 within a 10-minute window) from a single IP address to various accounts or workstations. This behavior is indicative of a brute-force attack or password guessing attempt against network services, particularly when the logon type is network (3) or remote interactive (10) and not from localhost.
Detects modifications to critical registry settings that weaken security controls related to NTLM authentication, Restricted Admin mode, and RDP security. The rule specifically looks for disabling NTLM traffic restrictions (RestrictSendingNTLMTraffic set to 0), disabling Restricted Admin mode (DisableRestrictedAdmin set to 0), or weakening RDP security by setting the SecurityLayer to '1'. An alert is generated if two or more such modifications occur within a 7-day timeframe.
Detects a pattern indicative of an NTLM relay attack following an authentication coercion spray. The rule first identifies a single source IP generating a high volume of failed NTLM logon attempts across multiple critical servers in a short time. It then looks for a subsequent successful NTLM logon from that same source IP to a high-value target (like a Certificate Authority) using a machine account. This sequence is a strong indicator that an attacker coerced credentials and is now relaying them to escalate privileges.
Page 3 of 7