Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
985 detections
Filters
Last updated
All Time
Detection languages
640
105
82
64
34
Contributors
242
226
216
58
46
Categories
20,439
11,829
5,873
5,151
4,864
985
Platforms
485
405
224
192
62
Products / Services
416
384
182
109
81
MITRE Techniques
498
497
264
235
234
CVEs
4
4
4
3
3
IDS Classtypes
1
This rule detects unscheduled modifications to federation, application, or service principal credentials, including ADFS token-signing certificates, in both Azure AD (via O365 management activity logs) and local Windows environments (via Security Event Logs). It filters these events against a known rotation schedule to highlight suspicious, non-routine changes that may indicate persistence establishment or identity provider tampering.
Detects potential lateral movement by identifying users who have recently had a confirmed infostealer malware infection on a source host and subsequently initiate RDP or WinRM connections from a different host to internal network resources.
Detects non-interactive sign-in events where a refresh token is used to authenticate without satisfying a multi-factor authentication (MFA) requirement. This pattern is indicative of potential token theft and replay attacks, where an adversary uses a stolen refresh token to maintain persistence or access resources without triggering the expected MFA prompt.
Detects interactive (Logon Type 10) or network (Logon Type 3) authentication to Windows hosts originating from external, non-RFC1918 IP addresses using 'Negotiate' authentication. This pattern is indicative of potential lateral movement from a cloud-connected environment into on-premises infrastructure, specifically where an adversary might be leveraging stolen session artifacts or credentials to bypass standard Kerberos-based domain authentication.
Detects coordinated activity characteristic of NotPetya-like lateral movement. It identifies a local account authenticating across multiple hosts (credential reuse), followed by the creation of a transient Windows service (typically for remote command execution) and the invocation of rundll32.exe to execute a DLL export by ordinal on the same device.
Detects successful authentication events for accounts that have been dormant for at least 90 days, correlated with suspicious activity markers such as recent failed sign-in attempts, access from an unfamiliar geographic location or ASN, or a complete absence of historical sign-in activity.
Detects potential lateral movement by identifying NTLM authentication (Logon Type 3) to administrative network shares (ADMIN$, C$, IPC$) or high-frequency access to multiple hosts by the same user, which may indicate credential abuse or lateral movement attempts.
This rule detects instances of Kerberos Ticket-Granting Ticket (TGT) requests (Event IDs 4768 and 4769) that utilize the legacy RC4 encryption type (0x17). In modern Active Directory environments where AES is the standard for Kerberos, the use of RC4 can be a strong indicator of a Golden Ticket attack or other unauthorized ticket forging activities, as adversaries often force a downgrade to RC4 for easier offline cracking.
Detects anomalous sign-in behavior, including impossible travel (geo-velocity) and non-interactive authentication without MFA, specifically targeting patterns indicative of Adversary-in-the-Middle (AiTM) session token theft.
Detects high-risk domain account activity, specifically identifying either impossible-travel authentication patterns in cloud logs or rapid, multi-host interactive authentication fan-out within one hour. These detections are further correlated with subsequent RDP or WinRM session establishment, indicating potential lateral movement or compromise of legitimate accounts.
Detects potential credential dumping activity via DCSync, identified by a non-DC computer account performing directory replication (DRS GetNCChanges), correlated with subsequent suspicious Kerberos ticket requests (Event ID 4769) that utilize weak encryption (RC4 or legacy DES), which is often associated with Golden Ticket abuse.
Detects the clearing of Windows Event Logs via wevtutil, PowerShell, or registry modification, occurring within one hour of a remote interactive or network logon event on the same host. This pattern is indicative of anti-forensic activity often performed following lateral movement or prior to destructive actions like ransomware deployment.
Detects anomalous authentication behavior consistent with Adversary-in-the-Middle (AiTM) phishing attacks, specifically where an MFA-authenticated session is accessed from multiple, disjoint geographic locations or IP addresses within a short timeframe, indicating the replay of stolen session tokens.
This rule detects potential lateral movement via Remote Desktop Protocol (RDP) by identifying a single user account establishing RemoteInteractive (logon type 10) sessions to three or more distinct destination hosts within a 15-minute timeframe. This pattern is indicative of an attacker attempting to traverse a network from a compromised host.
This rule detects potential Kerberoasting activity by monitoring Kerberos Service Ticket requests (Event IDs 4768 and 4769) that utilize the weak RC4 encryption type (0x17). The rule filters for non-computer account activity and specific suspicious Ticket Options that are commonly associated with tool-based Kerberoasting attacks.
Detects potential Pass-the-Hash (PtH) activity by monitoring for NTLM network logons (Logon Type 3) that are associated with a blank WorkstationName, often indicating spoofing. This pattern is correlated with the assignment of special privileges (EventID 4672) to capture scenarios where stolen NTLM hashes are replayed for lateral movement into a system.
This rule detects potential lateral movement by identifying a single user account authenticating to three or more distinct hosts using NTLM via network (LogonType 3) or impersonation (LogonType 9) logons, which is characteristic of credential-based movement across a network.
Detects the creation of suspicious services that are preceded by an administrative SMB share (ADMIN$) connection and a network logon event (Type 3) from the same source. This pattern is commonly used by lateral movement tools (like PsExec) to execute payloads remotely by installing a service, accessing the administrative share to drop the binary, and executing the service.
Detects a multi-stage attack pattern involving a non-MFA login to a Citrix portal, followed by lateral movement, and concluding with ransomware deployment behaviors such as shadow copy deletion, recovery disablement, or the dropping of ransom notes associated with ALPHV/BlackCat ransomware.
Detects anomalous SMB network logon events (Logon Type 3) that are characteristic of NTLM relay attacks. This includes logons involving NTLM V1, anonymous logins, or logons lacking workstation information, which are often indicative of tools like Responder or other relaying utilities.
Detects successful RDP (Remote Desktop Protocol) logon events (Event ID 4624, Logon Type 10) where the source IP address is outside the predefined internal network ranges. This behavior is indicative of potential lateral movement, where an attacker attempts to access internal systems from an external, non-corporate source.
Page 6 of 47