Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
3
Categories
3
1
1
Platforms
3
Products / Services
10,553
9,767
6,699
4,418
3,742
MITRE Techniques
1
1
1
1
1
Detects mass LDAP enumeration queries consistent with a modified BloodHound collector scraping AD users, computers, groups, and GPO/ACL data — customized by CISA's red team to evade static EDR signatures.
Detects a DCSync (directory replication) request targeting the krbtgt account, which yields the key material needed to forge Golden Tickets and impersonate any domain user. CISA's red team DCSynced krbtgt early in its Active Directory compromise (AA26-237A).
Detects computer-account creation (Event ID 4741) by a non-administrative user, indicative of abuse of the default Machine Account Quota to join unauthorized machine accounts for privilege escalation, as exploited by CISA's red team.