Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
827 detections
Filters
Last updated
All Time
Detection languages
357
171
85
78
49
Contributors
249
169
139
40
32
Categories
329
229
129
111
108
Platforms
754
61
35
15
14
Products / Services
10,680
9,761
6,694
4,418
3,744
827
MITRE Techniques
236
232
203
189
94
CVEs
10
4
3
3
3
IDS Classtypes
8
7
3
2
1
IDS Protocols
10
4
3
3
2
The following analytic identifies the creation and quick deletion of a Domain Controller (DC) object within 30 seconds in an Active Directory environment, indicative of a potential DCShadow attack. This detection leverages Windows Security Event Codes 5137 and 5141, analyzing the duration between these events. This activity is significant as DCShadow allows attackers with privileged access to register a rogue DC, enabling unauthorized changes to AD objects, including credentials. If confirmed malicious, this could lead to unauthorized AD modifications, compromising the integrity and security of the entire domain.
The analytic detects attempts to reset the Directory Services Restore Mode (DSRM) administrator password on a Domain Controller. It leverages event code 4794 from the Windows Security Event Log, specifically looking for events where the DSRM password reset is attempted. This activity is significant because the DSRM account can be used similarly to a local administrator account, providing potential persistence for an attacker. If confirmed malicious, this could allow an attacker to maintain administrative access to the Domain Controller, posing a severe risk to the domain's security.
The following analytic identifies a source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. It leverages Event ID 4768, which is generated when the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT) and detects failure code 0x6, indicating the user is not found in the Kerberos database. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges. If confirmed malicious, this activity could lead to unauthorized access and potential privilege escalation within the Active Directory environment.
The analytic identifies a source endpoint failing to authenticate with multiple invalid users using the NTLM protocol. It leverages EventCode 4776 and calculates the standard deviation for each host, using the 3-sigma rule to detect anomalies. This behavior is significant as it may indicate a Password Spraying attack, where an adversary attempts to gain initial access or elevate privileges. If confirmed malicious, this activity could lead to unauthorized access or privilege escalation, posing a significant threat to the Active Directory environment. This detection is focused on domain controllers.
The analytic identifies an unusual number of Kerberos service ticket requests (Event ID 4769) originating from a single client address and account. It uses statistical analysis, specifically standard deviation and the 3-sigma rule, to detect anomalies. This activity is significant as it may indicate malicious behavior such as lateral movement, malware staging, or reconnaissance, potentially leading to unauthorized access to multiple endpoints and further compromise.
This analytic identifies a source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. It leverages Windows EventCode 4768, which is generated when the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT) and detects failure code `0x12` (credentials revoked). This behavior is significant as it may indicate a Password Spraying attack targeting disabled accounts, potentially leading to initial access or privilege escalation. If confirmed malicious, attackers could gain unauthorized access or elevate privileges within the Active Directory environment.
The analytic identifies a source endpoint failing to authenticate multiple valid users using the NTLM protocol, potentially indicating a Password Spraying attack. It leverages Event 4776 from Domain Controllers, calculating the standard deviation for each host and applying the 3-sigma rule to detect anomalies. This activity is significant as it may represent an adversary attempting to gain initial access or elevate privileges. If confirmed malicious, the attacker could compromise multiple accounts, leading to unauthorized access and potential lateral movement within the network.
Detects an RDP connection originating from a domain controller. This activity is highly suspicious as domain controllers should not typically initiate RDP connections to other machines. Such an event could indicate lateral movement by an attacker who has compromised the domain controller. The rule specifically filters out connections made by "Microsoft.Tri.Sensor.exe", which is associated with Microsoft Defender for Identity, to avoid false positives from legitimate security operations.
Detects the use of the 'Get-ADComputer' cmdlet with specific parameters or LDAP filters to identify systems configured for unconstrained delegation. This activity is often performed by adversaries during the reconnaissance phase to find targets for Kerberos-based attacks like credential theft.
This rule detects when a client secret is added to an application within Azure AD. While this action can be legitimate for application configuration and integration, it can also be abused by adversaries to establish persistence within the environment. By adding a secret, an attacker can maintain access to the application and potentially associated resources, even if their initial access method is remediated. The rule specifically looks for 'Update application' events related to 'Certificates and secrets management' in Azure AD Directory Audit logs.
Detect users who are newly created and then immediately assigned administrator level roles
This rule detects suspicious connections to the ADFS database via named pipes. It specifically looks for processes connecting to the `\\MICROSOFT##WID\tsql\query` named pipe on ADFS servers, excluding legitimate ADFS-related processes such as `Microsoft.Identity.Health.Adfs.PshSurrogate.exe`, `Microsoft.IdentityServer.ServiceHost.exe`, `AzureADConnect.exe`, `Microsoft.Tri.Sensor.exe`, `wsmprovhost.exe`, `mmc.exe`, `sqlservr.exe`, and `sqlwriter.exe`. Such connections from unauthorized processes may indicate an attempt to access ADFS for malicious purposes.
Detects potential exploitation attempts of the Netlogon Elevation of Privilege Vulnerability (CVE-2020-1472), also known as Zerologon. This rule specifically looks for Event ID 4742 (A computer account was changed) where the SubjectUserName is 'ANONYMOUS LOGON' and the TargetUserName matches a Domain Controller's machine account name (ending with '$'), while filtering out legitimate password changes by checking if 'PasswordLastSet' is not '-'.
Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments. Certipy can be used to enumerate Active Directory Certificate Services (AD CS) for misconfigurations, request certificates, and perform various attacks such as forging authentication certificates (ESC1, ESC2, ESC3, ESC4, ESC6, ESC7, ESC8, ESC9, ESC10). The rule looks for the executable name, original file name, description containing 'Certipy', or specific command-line arguments and flags commonly used by Certipy.
Detects read access to a domain user object from a non-machine account, which can indicate user enumeration activity within Active Directory. The rule specifically looks for Event ID 4662 (An operation was performed on an object) where the ObjectType corresponds to a user object and the AccessMask includes read property permissions. It filters out activity from machine accounts and specific Microsoft Online (MSOL) accounts to reduce false positives.
This rule detects potential exploitation attempts of CVE-2021-42278, also known as "noPac" or "sAMAccountName spoofing". The exploit involves an attacker creating a computer object with known credentials, then clearing its ServicePrincipalName (SPN) attribute. This manipulation grants the attacker additional permissions on the object, allowing them to make further changes. The detection logic specifically looks for Kerberos Key Distribution Center (KDC) events (EventIDs 35, 36, 37, 38) which indicate anomalies in PAC (Privilege Attribute Certificate) or ticket requests, consistent with the post-exploitation phase of CVE-2021-42278 where forged tickets are used.
Detects when a user account's User Account Control (UAC) flags are modified to enable weak encryption (DES) or disable Kerberos pre-authentication. This configuration can make the account vulnerable to Kerberoasting attacks, where an attacker can request a service ticket for the user and then offline crack the NTLM hash of the user's password if DES encryption is allowed, or if pre-authentication is disabled.
This rule detects potential exploitation attempts of CVE-2021-42287, a vulnerability related to Active Directory's SAM Account Name Spoofing. The exploit involves an attacker creating a computer object with known credentials, then clearing its ServicePrincipalName attribute. This manipulation grants the attacker additional permissions on the object, enabling further changes. The detection specifically looks for Event IDs 16990 (Object class and UserAccountControl validation failure) and 16991 (SAM Account Name validation failure) from the Microsoft-Windows-Directory-Services-SAM provider, which indicate issues during the creation or modification of Active Directory objects that are characteristic of this attack.
Detects the creation or removal of a computer account in Active Directory. This can be indicative of attacks such as DCShadow, which involves registering a rogue Domain Controller to manipulate Active Directory data. The rule specifically looks for Windows Security Event IDs 4741 (A computer account was created) and 4743 (A computer account was deleted).
Detects PowerShell activity where the 'Get-AdDefaultDomainPasswordPolicy' cmdlet is used to retrieve the default password policy for an Active Directory domain. This action can be performed by adversaries to understand password complexity requirements and account lockout policies, which can aid in planning brute-force or password-guessing attacks.
Detects reconnaissance activities targeting privileged Active Directory users or groups by monitoring Windows Security Event ID 4661. The rule specifically looks for access attempts to objects identified as privileged users or groups based on their Security Identifier (SID) suffixes or names containing 'admin'. It filters out activity from machine accounts to reduce false positives.
Page 39 of 40