Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
127 detections
Filters
Last updated
All Time
Detection languages
58
48
18
3
Contributors
46
18
17
16
11
Categories
58
53
27
16
14
Platforms
91
36
8
3
3
Products / Services
69
66
20
17
12
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
CVEs
1
1
1
This rule detects when a user account assigns a 'Global Administrator' or 'Owner' role from multiple distinct IP addresses within a one-hour window. This behavior can indicate a compromised account being used to escalate privileges or establish persistence from different locations.
This rule detects multiple unauthorized access attempts (5 or more within an hour) to sensitive Active Directory objects such as 'Admin', 'krbtgt', or 'Domain Admins'. It leverages Windows Security Event ID 4662, which indicates an operation was performed on an object, and filters for specific sensitive object names. The rule then groups these attempts by object, IP address, and user, alerting when a threshold of attempts is met.
This rule detects potential Kerberos Constrained Delegation attacks by monitoring Security Event ID 4769 (A Kerberos service ticket was requested) for tickets with the '0x80000000' option, which indicates a forwardable ticket. The rule then aggregates these events by target username, client address, and IP address, flagging instances where 8 or more such tickets are requested, which could indicate an attempt to abuse constrained delegation.
This rule detects when a user account assigns a 'Global Administrator' or 'Owner' role from multiple distinct IP addresses within a one-hour window. This behavior can indicate a compromised account being used to escalate privileges or establish persistence from different locations.
Detects modifications to the msDS-GroupMSAMembership attribute on Delegated Managed Service Account (dMSA) objects. Attackers may write the dMSA's own SID into this attribute to self-authorize credential extraction, establishing a self-sustaining Ouroboros loop.
This rule detects successful sign-ins to specific Microsoft 365 applications (identified by ApplicationId '08ad6f98-a4f8-4635-bb8d-f1a3044760f0' or '07c030f6-5743-41b7-ba00-0a6e85f37c17') from devices that have previously established a network connection with a process named 'cowork-svc'. The rule correlates network connection events with Azure AD sign-in events over a 30-day lookback period to identify potentially legitimate or suspicious activity related to 'cowork-svc' application usage.
This rule detects activity associated with a specific threat actor targeting FortiGate devices. It identifies network connections to known threat actor infrastructure IPs, attempts to access FortiGate management ports (443, 8443, 10443, 4443) over TCP, and successful administrative or VPN authentications from the threat actor's IPs in Fortinet/FortiGate logs. Additionally, it looks for DCSync-style directory replication access (event ID 4662) in Windows Security logs, indicating potential Active Directory compromise.
This rule detects attempts to access specific Active Directory object types (identified by their GUIDs) with an access mask of 0x100 (which typically indicates 'Write Property' access). It filters out common service accounts and system accounts to reduce noise.
This rule detects inbound network connections to Active Directory Web Services (ADWS) on port 9389, followed by either LDAP query events (Event ID 1644) or operations on Active Directory objects (Event ID 4662) originating from the same device. This combination of events can indicate reconnaissance or malicious activity targeting Active Directory, such as attempts to enumerate accounts or groups, or to modify AD objects.
Detects the use of dsquery.exe to enumerate users in Active Directory. This command-line utility is often used by attackers for reconnaissance to gather information about domain users.
SharpSuccessor is a .NET-based post-exploitation tool designed to weaponize the BadSuccessor attack discovered by Yuval Gordon (@YuG0rd) from Akamai. It allows a low-privileged user with 'CreateChild' permissions over any Organizational Unit (OU) in an Active Directory domain to escalate privileges to Domain Administrator. This detection rule identifies execution patterns or behavioral indicators linked to SharpSuccessor activity, which may signal privilege escalation attempts in Active Directory environments.
NTDS theft
KQL
Microsoft has observed compromises related to Bazacall resulting in theft of the Active Directory database using ntdsutil.exe.
https://www.proofpoint.com/us/blog/threat-insight/beyond-credentials-weaponizing-oauth-applications-persistent-cloud-access
This rule detects when multi-factor authentication (MFA) has been explicitly disabled for a user in Azure Active Directory. This activity could indicate an adversary attempting to bypass authentication mechanisms to gain unauthorized access or maintain persistence.
This rule detects modifications to Active Directory user accounts that could enable an attacker to control another user's or computer's account without needing their credentials. Specifically, it looks for changes to attributes related to delegation, such as 'msDS-AllowedToDelegateTo' and 'msDS-AllowedToActOnBehalfOfOtherIdentity', or the 'servicePrincipalName' attribute for user objects, which can be abused for Kerberoasting or other delegation attacks. Event ID 4738 indicates a user account was changed, and Event ID 5136 indicates a directory service object was modified.
This rule monitors and alerts when a user is added to the 'Global Administrator' or 'Device Administrator' roles within Azure Active Directory. These roles grant highly elevated privileges, making this activity critical for detecting potential persistence, privilege escalation, or initial access attempts by adversaries. The detection logic specifically looks for 'Add member to role' operations within the RoleManagement category, targeting the unique identifiers for these two sensitive administrative roles.
Detects when a security-enabled global group is deleted in a Windows environment. This activity can be indicative of an adversary attempting to remove traces of their presence or disrupt normal operations by deleting critical groups.
Detect when a user creates a new Discretionary Access Control List (DACL) in Active Directory for their own AD object. This can be an indicator of an adversary attempting to maintain persistence or escalate privileges by modifying permissions on their own account to grant themselves additional rights or to prevent other users from modifying their account.
This rule detects changes to user multi-factor authentication (MFA) methods within an organization. It identifies when MFA methods are added, removed, or when the default MFA method is changed. This helps audit MFA configuration changes, detect unauthorized or suspicious modifications to authentication methods, support incident response by identifying the actor and timestamp of the change, and ensure compliance with security policies requiring strong authentication.
This rule detects changes to user multi-factor authentication (MFA) configurations within Azure Active Directory. It identifies when MFA methods are added, removed, or changed for a user, providing details on the actor, target, and the specific changes made. This helps in auditing MFA configuration changes, detecting unauthorized modifications, supporting incident response, and ensuring compliance with security policies.
Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag to create a local copy of the Active Directory database. This activity can be used by attackers for various purposes, including extracting data for Bloodhound, gathering usernames for password spraying, or leveraging metadata for social engineering. While the snapshot does not contain password hashes, administrators sometimes store passwords in comment fields, which could be exposed.
Page 2 of 7