Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
228 detections
Filters
Last updated
All Time
Detection languages
91
56
25
20
16
Contributors
63
54
46
21
14
Categories
149
138
35
33
32
Platforms
196
22
7
4
3
Products / Services
10,660
9,755
6,689
4,418
3,748
228
MITRE Techniques
104
79
49
33
31
CVEs
3
3
3
2
1
IDS Classtypes
12
2
1
1
IDS Protocols
9
7
The following analytic detects the creation of files in the Windows %startup% folder, a common persistence technique. It leverages the Endpoint.Filesystem data model to identify file creation events in this specific directory. This activity is significant because adversaries often use the startup folder to ensure their malicious code executes automatically upon system boot or user logon. If confirmed malicious, this could allow attackers to maintain persistence on the host, potentially leading to further system compromise and unauthorized access to sensitive information.
Detects a potential 'UnPAC the Hash' Kerberos attack, a technique used by Akira ransomware. The attack involves requesting an Active Directory certificate and then using it for a User-to-User (U2U) Kerberos authentication with PKINIT to extract NTLM hashes.
The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem data model to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity is significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID). This could be a sign of exploitation of elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping. Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.
Detects the exploitation of CVE-2022-37966, a security bypass and elevation of privilege vulnerability in Kerberos that allows for weak RC4-HMAC negotiation. This event indicates a Kerberos KDC error related to this vulnerability.
Detects errors when a target server doesn't have suitable keys for generating Kerberos tickets. This issue can occur, for example, when a service uses a user account or a computer account that is configured for only DES encryption on a computer that is running Windows 7 which has DES encryption for Kerberos authentication disabled. This can indicate a misconfiguration or an attempt by an attacker to exploit weak encryption types.
This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. Threat actors like Static Tundra have been observed configuring TFTP servers to make device configuration files accessible for exfiltration after gaining initial access. The detection specifically looks for commands that expose critical configuration files such as startup-config, running-config, and other sensitive system information through TFTP. This activity is particularly concerning as it may represent an attempt to steal credentials, network topology information, and other sensitive data stored in device configurations.
Password Spray Using Kerberos Pre-Auth
Cortex XDR
This query detects Kerberos pre-authentication attempts where the captured source address is external.
You can tweak and remove the RFC's to also look at internal requests, but expect some noise.
In addition, you might want to tweak the counter.
You can tweak and remove the RFC's to also look at internal requests, but expect some noise.
In addition, you might want to tweak the counter.
The following analytic detects the creation or connection of anonymous pipes for inter-process communication (IPC) within a Windows environment. Anonymous pipes are commonly used by legitimate system processes, services, and applications to transfer data between related processes. However, adversaries frequently abuse anonymous pipes to facilitate stealthy process injection, command-and-control (C2) communication, credential theft, or privilege escalation. This detection monitors for unusual anonymous pipe activity, particularly involving non-system processes, unsigned executables, or unexpected parent-child process relationships. While legitimate use cases exist—such as Windows services, software installers, or security tools—unusual or high-frequency anonymous pipe activity should be investigated for potential malware, persistence mechanisms, or lateral movement techniques.
The analytic detects potentially suspicious modifications to Windows Audit Policy auditing options registry values. It focuses on changes to specific auditing option values ("CrashOnAuditFail", "FullPrivilegeAuditing", "AuditBaseObjects", "AuditBaseDirectories") within the "HKLM\System\CurrentControlSet\Control\Lsa\" registry key. Such modifications could indicate a threat actor attempting to tamper with audit policy configurations, potentially disabling SACLs (System Access Control Lists) to bypass defenses and facilitate further malicious activities like machine compromise or lateral movement.
Detects suspicious Kerberos Ticket Granting Ticket (TGT) requests where pre-authentication is disabled (Pre-Authentication Type = 0) and the ticket encryption type is RC4-HMAC (0x17). This combination is indicative of an AS-REP Roasting attack, where an adversary requests AS-REP messages for accounts without pre-authentication and attempts to crack the encrypted ticket offline to recover user passwords.
KQL Query from file: Kerberos Roasting Detection
'A service principal name (SPN) is used to uniquely identify a service instance in a Windows environment.
Each SPN is usually associated with a service account. Organizations may have used service accounts with weak passwords in their environment.
An attacker can try requesting Kerberos ticket-granting service (TGS) service tickets for any SPN from a domain controller (DC) which contains a hash of the Service account. This can then be used for offline cracking.
This hunting query looks for accounts that are generating excessive requests to different resources within the last hour compared with the previous 24 hours. Normal users would not make an unusually large number of request within a small time window. This is based on 4769 events which can be very noisy so environment based tweaking might be needed.'
Each SPN is usually associated with a service account. Organizations may have used service accounts with weak passwords in their environment.
An attacker can try requesting Kerberos ticket-granting service (TGS) service tickets for any SPN from a domain controller (DC) which contains a hash of the Service account. This can then be used for offline cracking.
This hunting query looks for accounts that are generating excessive requests to different resources within the last hour compared with the previous 24 hours. Normal users would not make an unusually large number of request within a small time window. This is based on 4769 events which can be very noisy so environment based tweaking might be needed.'
'This query looks at Account Logon events found through Windows Event Id's as well as SigninLogs to discover
login attempts by accounts that have expired.'
login attempts by accounts that have expired.'
This query aim to detect if someone requests service tickets (where count => maxcount)
The query requires trimming to set a baseline level for MaxCount
Mitre Technique: Kerberoasting (T1558.003)
@MattiasBorg82
The query requires trimming to set a baseline level for MaxCount
Mitre Technique: Kerberoasting (T1558.003)
@MattiasBorg82
Microsoft Defender for Identity raises alert on suspicious Kerberos ticket, pointing to a potential overpass-the-hash attack.
Once attackers gain credentials for a user with higher privileges, they will use the stolen credentials to sign into other devices and move laterally.
This query finds related sign-in events following overpass-the-hash attack to trace the footprint of the impersonated user.
Once attackers gain credentials for a user with higher privileges, they will use the stolen credentials to sign into other devices and move laterally.
This query finds related sign-in events following overpass-the-hash attack to trace the footprint of the impersonated user.
This query shows attempts to request Kerberos service ticket using the AS service, to monitor Kerberos AS authentications.
This analytic detects suspicious modifications to Unix shell configuration files, such as `.bashrc` or `.profile`, which may indicate an attempt to alter system behavior or gain unauthorized access. Unauthorized changes to these files can be used to execute malicious commands, escalate privileges, or hide malicious activities. By monitoring for unusual or unauthorized modifications to shell configuration files, this analytic helps identify potential security threats, allowing security teams to respond quickly and mitigate risks.
The following analytic detects attempts to stop a service on Linux systems. It leverages data from Linux Auditd. This activity is significant as adversaries often stop or terminate security or critical services to disable defenses or disrupt operations, as seen in malware like Industroyer2. If confirmed malicious, this could lead to the disabling of security mechanisms, allowing attackers to persist, escalate privileges, or deploy destructive payloads, severely impacting system integrity and availability.
The following analytic detects the suspicious auditd service stop. This behavior is critical for a SOC to monitor because it may indicate attempts to gain unauthorized access or maintain control over a system. Such actions could be signs of malicious activity. If confirmed, this could lead to serious consequences, including a compromised system, unauthorized access to sensitive data, or even a wider breach affecting the entire network. Detecting and responding to these signs early is essential to prevent potential security incidents.
The analytic detects cloud API calls executed by user roles that have not previously run these commands. It leverages the Change data model in Splunk to identify commands executed by users with the user_type of AssumedRole and a status of success. This activity is significant because new commands from different user roles can indicate potential malicious activity or unauthorized actions. If confirmed malicious, this behavior could lead to unauthorized access, data breaches, or other damaging outcomes by exploiting new or unmonitored commands within the cloud environment.
Page 9 of 11