Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,456
11,839
5,876
5,155
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
The following analytic detects the execution of the `Get-DomainUser` or `Get-NetUser` PowerShell cmdlets with the `-SPN` parameter, indicating the use of PowerView for SPN discovery. It leverages PowerShell Script Block Logging (EventCode=4104) to identify these specific commands. This activity is significant as it suggests an attempt to enumerate domain accounts associated with Service Principal Names (SPNs), a common precursor to Kerberoasting attacks. If confirmed malicious, this could allow an attacker to identify and target accounts for credential theft, potentially leading to unauthorized access and privilege escalation within the network.
This rule detects the execution of the `Get-DomainUser` commandlet with the `-PreauthNotRequired` parameter using PowerShell Script Block Logging (EventCode=4104). This command is part of PowerView, a tool used for enumerating Windows Active Directory networks. Identifying domain accounts with Kerberos Pre-Authentication disabled is significant because adversaries can leverage this information to attempt offline password cracking (AS-REP Roasting). If confirmed malicious, this activity could lead to unauthorized access to domain accounts, potentially compromising sensitive information and escalating privileges within the network.
Detects potential Raven Stealer activity by identifying known artifacts such as specific file paths, created filenames, command-line arguments, network connections, and file hashes.
This detection identifies the use of common post-exploitation tools like PsExec, Impacket (specifically WMIExec), and Mimikatz. These tools are frequently used by threat actors for lateral movement and credential access after gaining initial access. The rule looks for specific process names and command-line arguments indicative of these tools.
Detects when a virtual disk (.vmdk) from one virtual machine is attached to a different virtual machine. This is a key TTP used by threat groups like UNC3944 to perform offline credential theft (e.g., copying NTDS.dit from a domain controller) by mounting the disk to a separate, attacker-controlled staging VM.
Detects components of the KimJongRAT PE variant, including the orchestrator (NetworkService.dll), loader (sys.dll/baby.dll), and stealer (dwm.dll), based on unique strings, PDB paths, and network communication artifacts.
This rule detects a sequence of successful Azure AD sign-ins from the same user and device. The first sign-in uses a refresh token (RT) for a non-interactive user session, specifically for the Microsoft Teams desktop client (app ID 29d9ed98-a469-4536-ade2-f981bc1d605e) from an Azure AD joined device, where the token protection status is 'unbound'. This is followed by a second successful sign-in using a primary refresh token (PRT) from the same user and device, excluding sign-ins to the 'Device Registration Service'. This sequence could indicate an adversary attempting to transition from an acquired refresh token to a primary refresh token, potentially to gain broader access or persistence within the Azure AD environment.
This rule detects inbound emails containing URLs that are commonly used for OAuth consent phishing, where an attacker attempts to trick users into granting permissions to a malicious application.
Detects the creation of specific text files in the AppData directory, which is a known behavior of the Katz Stealer malware after it successfully decrypts and dumps browser master keys.
This query detects PowerShell and command-line activities associated with Active Directory reconnaissance, focusing on:
- Account & Group Discovery (T1087, T1069)
-- Local/Domain user/group enumeration (Get-ADUser, net user, Get-LocalGroupMember).
- Password Policy Discovery (T1201)
-- Checks domain password rules (Get-ADDefaultDomainPasswordPolicy, net accounts /domain).
- Domain Trust & Network Mapping (T1482, T1135, T1016)
-- Trust relationships (nltest /domain_trusts), shares (net share), and DNS/IP config (ipconfig).
- Lateral Movement Prep (T1021.002, T1213.002)
-- SMB share access (net use), AD object/ACL dumping (Get-ADObject).
Why It Matters:
Adversaries use these commands to map the AD environment before attacks like:
- Brute-forcing (using password policy info from T1201).
- Privilege escalation (via group membership data from T1069).
- Lateral movement (via share/trust discovery from T1135/T1482).
- Account & Group Discovery (T1087, T1069)
-- Local/Domain user/group enumeration (Get-ADUser, net user, Get-LocalGroupMember).
- Password Policy Discovery (T1201)
-- Checks domain password rules (Get-ADDefaultDomainPasswordPolicy, net accounts /domain).
- Domain Trust & Network Mapping (T1482, T1135, T1016)
-- Trust relationships (nltest /domain_trusts), shares (net share), and DNS/IP config (ipconfig).
- Lateral Movement Prep (T1021.002, T1213.002)
-- SMB share access (net use), AD object/ACL dumping (Get-ADObject).
Why It Matters:
Adversaries use these commands to map the AD environment before attacks like:
- Brute-forcing (using password policy info from T1201).
- Privilege escalation (via group membership data from T1069).
- Lateral movement (via share/trust discovery from T1135/T1482).
Looking for processes executing chrome / edge with a remote debugging port, this is typically seen being leverage by info stealer malware to steal credentials.
The remote debugging functionality can be used to obtain cookies without requiring keychain access.
The remote debugging functionality can be used to obtain cookies without requiring keychain access.
Detects command-line and PowerShell attempts to discover Windows domain/local password policies, which adversaries use to plan brute-force attacks or credential exploitation.
Each command is a reconnaissance step to answer:
"How many guesses can I make before lockout?"
"What password complexity rules exist?"
"Which domains have weaker policies?"
This aligns with MITRE’s definition of T1201.
Each command is a reconnaissance step to answer:
"How many guesses can I make before lockout?"
"What password complexity rules exist?"
"Which domains have weaker policies?"
This aligns with MITRE’s definition of T1201.
Detects a non-interactive sign-in using a refresh token for the Microsoft Authentication Broker client, targeting the Device Registration Service (DRS) with the 'adrs_access' scope. This specific combination of attributes is highly indicative of an adversary using tools like ROADtools to register a malicious device in the tenant following a successful OAuth phishing attack.
Detects successful user authentication using the FIDO2/WebAuthn cross-device (hybrid) sign-in feature. This technique can be abused by attackers in Adversary-in-the-Middle (AiTM) phishing campaigns to bypass FIDO key protections, as seen in the PoisonSeed campaign.
Detects the successful registration of a new FIDO2/WebAuthn security key for a user account. This activity can be legitimate, but attackers who have compromised an account may register their own FIDO key to maintain persistent access. This activity should be correlated with other suspicious events, such as a recent password reset or login from an unusual location.
Detects Microsoft Entra ID sign-in events where a user principal authenticates using a refresh token issued to the Microsoft Authentication Broker (MAB) client, targeting the Device Registration Service (DRS) with the "adrs_access" OAuth scope. This pattern may indicate token-based access to DRS following an initial authorization code phishing or as a precursor to malicious device registration using tools like ROADtx.
This detection monitors for signs of a shared or potentially compromised root account on ESXi hosts by tracking the number of unique IP addresses logging in as root within a short time window. Multiple logins from different IPs in a brief period may indicate credential misuse, lateral movement, or account compromise.
This analytic identifies processes accessing FileZilla XML configuration files (recentservers.xml and sitemanager.xml) by monitoring Windows Security Event Code 4663. This activity is considered unusual if not performed by the legitimate FileZilla application or OneDrive, and can indicate unauthorized access or manipulation of sensitive configuration files. Such access could lead to data exfiltration, credential theft, or further system compromise.
This rule detects potentially malicious sign-in attempts that occur shortly after a user clicks on a URL, especially when the sign-in originates from a different IP address or subnet than the URL click. It specifically looks for risky sign-ins to Microsoft first-party applications. The logic aims to identify scenarios where a user might be phished (e.g., via a malicious link) and then their credentials are used to sign in from an attacker-controlled location.
This rule is designed to identify any non-bot user accessing an unusually high number of repositories in a short time window (30 mins), which may indicate credential abuse or insider threat activity.
This rule detects attempts to transfer sensitive files containing credential data via network shares. It specifically looks for Event ID 5145 (A network share object was checked to see whether client can be granted desired access) and checks if the 'RelativeTargetName' of the accessed object contains well-known filenames or paths associated with credential storage, such as Mimikatz output, LSASS memory dumps, Windows minidumps, hibernation files, SQL dumps, or critical system files like NTDS.dit, SAM, SECURITY, and SYSTEM hives.
Page 172 of 206