Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,311 detections
Filters
Last updated
All Time
Detection languages
2,035
733
398
299
243
Contributors
1,048
740
503
372
239
Categories
20,453
11,837
5,876
5,154
4,865
4,311
Platforms
2,572
793
615
382
319
Products / Services
767
740
659
513
348
MITRE Techniques
2,350
917
848
814
635
CVEs
9
6
6
6
5
IDS Classtypes
81
66
44
14
14
IDS Protocols
136
79
11
7
4
KQL Query from file: Detecting Nation State Actors @ Near Realtime
KQL Query from file: Sentinel Timeroasting KQL detection
KQL Query
KQL Query from file: Identity Blast Radius
KQL Query
KQL Query from file: HTTP Client Tools Exploitation for ATO Detection
KQL Query from file: CVE-2024-38200 NTLM Exposure Detection
Detects the execution of the Doppelganger hacktool, which is designed to dump LSASS memory by cloning processes to evade common detection methods. The rule identifies this activity by looking for specific executable names or known ImpHash values associated with the Doppelganger tool.
This rule detects attempts to access the Windows share IPC with the specific target name "cert," which could indicate unauthorized certificate requests. This behavior has been linked to tools such as Certipy.
KQL Query from file: MDE KQL to detect TA571 socialengineering abuse
SPL Query from file: NTDS.DIT Exfiltration Detection
Identifies suspicious access to sensitive browser files by processes commonly used by Lumma Stealer, expanding coverage to include more browsers based on observed configurations.
Detects changes to the "DisableRestrictedAdmin" registry value, which controls RestrictedAdmin mode. Disabling RestrictedAdmin mode can expose credentials to compromise during Remote Desktop Protocol (RDP) connections, making it easier for adversaries to harvest credentials during lateral movement. This rule identifies modifications to this critical security setting.
Detects potential malicious modification of the 'UseLogonCredential' property value within the WDigest registry key to enable clear-text credential storage. This modification can allow attackers to dump credentials from LSASS memory.
This analytic detects the use of the Certify tool via an in-memory PowerShell function to enumerate Active Directory Certificate Services (AD CS) environments. It leverages PowerShell Script Block Logging (EventCode 4104) to identify specific command patterns associated with Certify's enumeration and exploitation functions. This activity is significant as it indicates potential reconnaissance or exploitation attempts against AD CS, which could lead to unauthorized certificate issuance. If confirmed malicious, attackers could leverage this to escalate privileges, persist in the environment, or access sensitive information by abusing AD CS.
The analytic detects the execution of the Get-GPPPassword or Get-CachedGPPPassword PowerShell cmdlets, which are used to search for unsecured credentials in Group Policy Preferences (GPP). This detection leverages PowerShell Script Block Logging to identify specific script block text associated with these cmdlets. Monitoring this activity is crucial as it can indicate an attempt to retrieve and decrypt stored credentials from SYSVOL, potentially leading to unauthorized access. If confirmed malicious, this activity could allow an attacker to escalate privileges or move laterally within the network by exploiting exposed credentials.
This detection identifies when an Azure Service Principal elevates privileges by adding itself to a new app role assignment. This activity is indicative of privilege escalation within an Azure Active Directory environment, where a service principal grants itself additional permissions.
This analytic detects the execution of the PowerShell command 'Get-Clipboard' to retrieve clipboard data. It leverages PowerShell Script Block Logging (EventCode 4104) to identify instances where this command is used. This activity is significant because it can indicate an attempt to steal sensitive information such as usernames, passwords, or other confidential data copied to the clipboard. If confirmed malicious, this behavior could lead to unauthorized access to sensitive information, potentially compromising user accounts and other critical assets.
This analytic detects the use of the PowerShell Cmdlet `export-certificate` by leveraging Script Block Logging. This activity is significant as it may indicate an adversary attempting to exfiltrate certificates from the local Certificate Store on a Windows endpoint. Monitoring this behavior is crucial because stolen certificates can be used to impersonate users, decrypt sensitive data, or facilitate further attacks. If confirmed malicious, this activity could lead to unauthorized access to encrypted communications and sensitive information, posing a severe security risk.
The analytic detects the use of the PowerShell cmdlet `export-pfxcertificate` by leveraging Script Block Logging. This activity is significant as it may indicate an adversary attempting to exfiltrate certificates from the Windows Certificate Store. Monitoring this behavior is crucial for identifying potential certificate theft, which can lead to unauthorized access and impersonation attacks. If confirmed malicious, this activity could allow attackers to compromise secure communications, authenticate as legitimate users, and escalate their privileges within the network.
The analytic detects the use of the `Set-ADAccountControl` PowerShell cmdlet with parameters that disable Kerberos Pre-Authentication. It leverages PowerShell Script Block Logging (EventCode=4104) to identify this specific command execution. Disabling Kerberos Pre-Authentication is significant because it allows adversaries to perform offline brute force attacks against user passwords using the AS-REP Roasting technique. If confirmed malicious, this activity could enable attackers to escalate privileges or maintain persistence within an Active Directory environment, posing a severe security risk.
Page 176 of 206