Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
827 detections
Filters
Last updated
All Time
Detection languages
357
171
85
78
49
Contributors
249
169
139
40
32
Categories
329
229
129
111
108
Platforms
754
61
35
15
14
Products / Services
10,680
9,761
6,694
4,418
3,744
827
MITRE Techniques
236
232
203
189
94
CVEs
10
4
3
3
3
IDS Classtypes
8
7
3
2
1
IDS Protocols
10
4
3
3
2
The following analytic detects changes to the sIDHistory attribute of user or computer objects across different domains. It leverages Windows Security Event Codes 4738 and 4742 to identify when the sIDHistory attribute is modified. This activity is significant because the sIDHistory attribute allows users to inherit permissions from other AD accounts, which can be exploited by adversaries for inter-domain privilege escalation and persistence. If confirmed malicious, this could enable attackers to gain unauthorized access to resources, maintain persistence, and escalate privileges across domain boundaries.
The following analytic identifies a genuine Domain Controller (DC) promotion event by detecting when a computer assigns itself the necessary Service Principal Names (SPNs) to function as a domain controller. It leverages Windows Security Event Code 4742 to monitor existing domain controllers for these changes. This activity is significant as it can help identify rogue DCs added to the network, which could indicate a DCShadow attack. If confirmed malicious, this could allow an attacker to manipulate Active Directory, leading to potential privilege escalation and persistent access within the environment.
This analytic detects the addition of a new member to the DnsAdmins group in Active Directory by leveraging Windows Security Event ID 4732. Monitoring this activity is crucial because members of the DnsAdmins group can manage the DNS service, often running on Domain Controllers, and potentially execute malicious code with SYSTEM privileges. If confirmed malicious, this activity could allow an attacker to escalate privileges and gain control over critical domain services, posing a significant security risk.
This detection monitors the addition of specific dangerous Access Control List (ACL) entries to an Active Directory group object. These ACL modifications, such as "Full control", "All extended rights", "Modify permissions", or "Write all properties", can indicate potential privilege escalation or malicious activity within the Active Directory environment. Immediate investigation is recommended upon alert to determine the legitimacy and intent behind such changes.
This analytic detects the execution of the 'shred' command on a Linux machine, which is used to overwrite files to make them unrecoverable. It leverages data from Linux Auditd, focusing on process names and command-line arguments. This activity is significant because the 'shred' command can be used in destructive attacks, such as those seen in the Industroyer2 malware targeting energy facilities. If confirmed malicious, this activity could lead to the permanent destruction of critical files, severely impacting system integrity and data availability.
This detection identifies when an Active Directory Group Policy is deleted using the Group Policy Management Console. Deleting Group Policy Objects (GPOs) can be a legitimate administrative action, but it can also be used by adversaries to remove security controls, disable logging, or clean up traces of their activity. Monitoring for GPO deletions is crucial for maintaining the integrity of an Active Directory environment.
This rule detects when the owner of an Active Directory object is updated. Changing an object's owner grants full control over that object, which can be a significant privilege escalation or a precursor to hiding an AD object. The rule specifically looks for EventCode 5136 in Windows Security Event Logs, filtering for changes in the 'owner' attribute.
The analytic identifies potential Kerberos ticket forging attacks, specifically the Diamond Ticket attack. This is detected when a user logs into a host and the GroupMembership field in event 4627 indicates a privileged group (e.g., Domain Admins), but the user does not actually belong to that group in the directory service. The detection leverages Windows Security Event Log 4627, which logs account logon events. The analytic cross-references the GroupMembership field from the event against a pre-populated lookup of actual group memberships. Any discrepancies between the events GroupMembership and the lookup indicate potential ticket forging. Kerberos ticket forging, especially the Diamond Ticket attack, allows attackers to impersonate any user and potentially gain unauthorized access to resources. By forging a ticket that indicates membership in a privileged group, an attacker can bypass security controls and gain elevated privileges. Detecting such discrepancies in group memberships during logon events can be a strong indicator of this attack in progress.
This detection identifies an Active Directory access-control list (ACL) modification event, specifically focusing on changes that apply deny permissions to prevent enumeration of object permissions. Such modifications can be used by adversaries for persistence or to hide malicious objects within Active Directory by making them harder to discover.
This detection monitors the addition of dangerous Access Control Lists (ACLs) to an Active Directory user object. Specifically, it looks for modifications that grant "Full control", "All extended rights", "All validated writes", "Create all child objects", "Delete all child objects", "Delete subtree", "Delete", "Modify permissions", "Modify owner", or "Write all properties" to a user object. Such modifications can indicate potential privilege escalation or malicious activity within the Active Directory environment. Immediate investigation is recommended upon alert.
This analytic identifies a source host failing to authenticate against a remote host with 30 unique users. It leverages Windows Event 4625 with Logon Type 3, indicating remote authentication attempts. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges in an Active Directory environment. If confirmed malicious, this activity could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information. This detection is crucial for real-time security monitoring and threat hunting.
The following analytic identifies an excessive number of authentication failures, including failed attempts against MFA prompt codes. It uses data from the `o365_management_activity` dataset, focusing on events where the authentication status is marked as failure. This behavior is significant as it may indicate a brute force attack or an attempt to compromise user accounts. If confirmed malicious, this activity could lead to unauthorized access, data breaches, or further exploitation within the environment.
This analytic detects instances where a user adds themselves to an Active Directory (AD) group. This activity is a common indicator of privilege escalation, where a user attempts to gain unauthorized access to higher privileges or sensitive resources. By monitoring AD logs, this detection identifies such suspicious behavior, which could be part of a larger attack strategy aimed at compromising critical systems and data.
The following analytic identifies a source endpoint failing to authenticate multiple valid users using the Kerberos protocol, potentially indicating a Password Spraying attack. It leverages Event 4771, which is generated when the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket (TGT) due to a wrong password (failure code 0x18). This detection uses statistical analysis, specifically the 3-sigma rule, to identify unusual authentication failures. If confirmed malicious, this activity could allow an attacker to gain initial access or elevate privileges within an Active Directory environment.
The following analytic identifies a source host failing to authenticate against a remote host with multiple users, potentially indicating a Password Spraying attack. It leverages Windows Event 4625 (failed logon attempts) and Logon Type 3 (remote authentication) to detect this behavior. This activity is significant as it may represent an adversary attempting to gain initial access or elevate privileges within an Active Directory environment. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and further compromise of the network.
This rule detects the deletion of Access Control List (ACL) entries on the domain root object within Active Directory. Such an action is a significant change with high impact, as it can alter fundamental security permissions for the entire domain. Microsoft guidance suggests that all changes at this level should be reviewed. The rule extracts details about the old and new ACL values, the operation type, the affected object, and the user performing the action. It also attempts to resolve SIDs to user or group names for better context.
This analytic detects an increase in modifications to Active Directory groups or objects. Frequent changes to AD groups or objects can indicate potential security risks, such as unauthorized access attempts, impairing defenses, or establishing persistence. By monitoring AD logs for unusual modification patterns, this detection helps identify suspicious behavior that could compromise the integrity and security of the AD environment. The rule specifically looks for a statistically significant increase in the number of unique objects modified by a source user over a 5-minute span, compared to their historical average and standard deviation.
The analytic detects a high volume of Kerberos service ticket requests (more than 30) from a single source within a 5-minute window, specifically focusing on requests with computer names as the Service Name (Event ID 4769). This behavior may indicate malicious activities such as lateral movement, malware staging, or reconnaissance, potentially leading to unauthorized access and network compromise.
The analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell to query Active Directory for root domain linked policies. This activity is identified by leveraging PowerShell Script Block Logging (EventCode=4104) and looking for specific keywords like `[adsisearcher]`, `SearchRooT`, and `gplink`. This behavior is significant as it may indicate an attempt by adversaries or Red Teams to gain situational awareness and perform Active Directory Discovery, potentially aiding in further exploitation or lateral movement within the network.
This detection identifies when an Active Directory Group Policy Object (GPO) is disabled. Adversaries may disable GPOs to impair defenses, remove security policies, or facilitate other malicious activities within the domain. The rule specifically looks for EventCode 5136 with AttributeLDAPDisplayName 'flags' and an AttributeValue indicating the GPO is disabled (values 1, 2, or 3). It then joins this with Active Directory monitoring data to get the display name of the GPO.
This analytic identifies when the Security Identifier (SID) of a privileged user is added to the SID History attribute of another user account in Active Directory. It specifically looks for Windows Security Event Codes 4742 (A computer account was changed) and 4738 (A user account was changed), combined with identity lookups to determine if the added SID belongs to a privileged account. This activity is critical as it can indicate an attempt to abuse SID history for unauthorized access, privilege escalation, or persistent access within an environment, posing a significant security risk.
Page 38 of 40