Dan Zero
@danzeroCompletionist
0 followers16 downloads37 copies3 likes457 views
4 detections
Filters
Last updated
All Time
Detection languages
4
Categories
1
1
Platforms
2
MITRE Techniques
2
1
1
1
1
This KQL query monitors a critical security event in Active Directory Federation Services (ADFS) environments - the reading of Distributed Key Management (DKM) properties.
This KQL query is designed to identify potentially unauthorized communications with popular AI services and large language models (LLMs) from organizational endpoints.
This technique involves adversaries modifying access control lists (ACLs) in Active Directory to maintain access to domain resources. Specifically, this detection identifies when a DACL (Discretionary Access Control List) is changed to grant "GenericAll" rights, which provide complete control over an AD object.
This detection identifies potential NTLM relay activity by correlating named pipe access to \netdfs (commonly abused in DFSCoerce attacks) with NTLM challenge traffic within a short time window. Attackers can exploit this technique to coerce authentication and perform NTLM relay, enabling lateral movement or privilege escalation in Active Directory environments.