Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
81 detections
Filters
Last updated
All Time
Detection languages
46
22
3
3
3
Contributors
16
11
7
5
5
Categories
36
28
14
13
12
Platforms
64
13
7
2
2
Products / Services
21
18
13
8
7
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
CVEs
6
1
IDS Classtypes
1
IDS Protocols
1
Multi-layered detection rule that identifies anomalous behavior on privileged accounts across six independent detection layers: absolute rule violations ("never actions"), self-calibrating ratio-based thresholds, behavioral technique substitution (e.g., WMI drop-off while other lateral movement continues), time-series statistical anomaly detection via series_decompose_anomalies(), reconnaissance burst detection on LDAP/directory queries, and MFA gap analysis. All layers roll up into a composite risk score for analyst prioritization. Originally derived from diffpatterns() analysis of real penetration test data vs. normal operations, this community edition replaces environment-specific hardcoded thresholds with self-calibrating statistical baselines. Requires Microsoft Defender for Identity and Entra ID Sign-in Logs.
This rule detects inbound network connections to Active Directory Web Services (ADWS) on port 9389, followed by either LDAP query events (Event ID 1644) or operations on Active Directory objects (Event ID 4662) originating from the same device. This combination of events can indicate reconnaissance or malicious activity targeting Active Directory, such as attempts to enumerate accounts or groups, or to modify AD objects.
This rule detects suspicious user-agent strings in Microsoft Graph activity logs that are commonly associated with reconnaissance and attack tools targeting Azure AD and Microsoft 365 environments. These tools include BloodHound, ROADtools, AADInternals, and various other utilities used for enumeration, credential spraying, and other malicious activities.
Detects Commandlet names from well-known PowerShell exploitation frameworks
Detects Commandlet names from well-known PowerShell exploitation frameworks
Detects Commandlet names from well-known PowerShell exploitation frameworks
Detects scenarios where an attacker enumerates local administratos group on multiple hosts via SharpHound.
Detects scenarios where an attacker attempts to enumerate local or domain groups via commandline.
Detects scenarios where an attacker enumerates domain group with tools like CME (--groups).
Detects scenarios where an attacker attempts to enumerate domain local groups with tools like CME (--local-groups).
Detects scenarios where an attacker attempts to enumerate sensitive domain group settings and membership.
This query detects PowerShell and command-line activities associated with Active Directory reconnaissance, focusing on:
- Account & Group Discovery (T1087, T1069)
-- Local/Domain user/group enumeration (Get-ADUser, net user, Get-LocalGroupMember).
- Password Policy Discovery (T1201)
-- Checks domain password rules (Get-ADDefaultDomainPasswordPolicy, net accounts /domain).
- Domain Trust & Network Mapping (T1482, T1135, T1016)
-- Trust relationships (nltest /domain_trusts), shares (net share), and DNS/IP config (ipconfig).
- Lateral Movement Prep (T1021.002, T1213.002)
-- SMB share access (net use), AD object/ACL dumping (Get-ADObject).
Why It Matters:
Adversaries use these commands to map the AD environment before attacks like:
- Brute-forcing (using password policy info from T1201).
- Privilege escalation (via group membership data from T1069).
- Lateral movement (via share/trust discovery from T1135/T1482).
- Account & Group Discovery (T1087, T1069)
-- Local/Domain user/group enumeration (Get-ADUser, net user, Get-LocalGroupMember).
- Password Policy Discovery (T1201)
-- Checks domain password rules (Get-ADDefaultDomainPasswordPolicy, net accounts /domain).
- Domain Trust & Network Mapping (T1482, T1135, T1016)
-- Trust relationships (nltest /domain_trusts), shares (net share), and DNS/IP config (ipconfig).
- Lateral Movement Prep (T1021.002, T1213.002)
-- SMB share access (net use), AD object/ACL dumping (Get-ADObject).
Why It Matters:
Adversaries use these commands to map the AD environment before attacks like:
- Brute-forcing (using password policy info from T1201).
- Privilege escalation (via group membership data from T1069).
- Lateral movement (via share/trust discovery from T1135/T1482).
Detects command-line and PowerShell attempts to discover Windows domain/local password policies, which adversaries use to plan brute-force attacks or credential exploitation.
Each command is a reconnaissance step to answer:
"How many guesses can I make before lockout?"
"What password complexity rules exist?"
"Which domains have weaker policies?"
This aligns with MITRE’s definition of T1201.
Each command is a reconnaissance step to answer:
"How many guesses can I make before lockout?"
"What password complexity rules exist?"
"Which domains have weaker policies?"
This aligns with MITRE’s definition of T1201.
Detects the execution of PowerShell commandlets commonly associated with well-known PowerShell exploitation frameworks and tools. This rule identifies specific commandlet names within process command lines, indicating potential malicious activity such as credential dumping, reconnaissance, privilege escalation, persistence, and lateral movement.
Detects Commandlet names from well-known PowerShell exploitation frameworks
Detects Commandlet names from well-known PowerShell exploitation frameworks
Detects Commandlet names from well-known PowerShell exploitation frameworks
Detects the use of known malicious PowerShell commandlets often associated with exploitation frameworks. These commandlets perform various adversarial actions such as credential dumping, reconnaissance, persistence, privilege escalation, and data exfiltration.
Detects the use of known malicious PowerShell commandlets often associated with exploitation frameworks, red-teaming tools, and malware. This rule identifies a wide range of offensive PowerShell functions used for reconnaissance, credential dumping, privilege escalation, persistence, and data exfiltration.
KQL Query from file: Threat Hunting AzureHound Usage
KQL Query from file: Sentinel KQL Detection for ShadowHound
Page 3 of 4