Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
839 detections
Filters
Last updated
All Time
Detection languages
438
190
77
62
40
Contributors
120
114
72
71
68
Categories
464
233
193
152
122
Platforms
288
274
154
88
56
Products / Services
220
169
162
90
76
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
839
CVEs
6
5
5
5
5
IDS Classtypes
4
2
IDS Protocols
1
This rule identifies and monitors deletion operations in Azure Active Directory (AAD) that could indicate unauthorized activity. It excludes routine deletions, such as security information or device removals, and captures details about the initiating user, target user/group, and their IP address. The rule helps detect potentially anomalous or suspicious deletion actions, enhancing AAD security monitoring.
Detects scenarios where an attacker attempts to spoof the SAM account name of a a domain controller in order to impersonate it. Vulnerability comes from that computer accounts should have a trailing $ in their name (i.e. sAMAccountName attribute) but no validation process existed until the patch was released. During the offensive phase, attacker will create and rename the sAMAccountName of a computer account to look like the one of a domain controller. Once the attack is done, attacker will rollback the sAMAccountName to its original name.
Detects scenarios where a new member is added to a sensitive group related to Exchange server
Detects scenarios where a new member is added to a sensitive administration group related to OCS/Lync/Skype for Business in order to scan topology, infiltrate servers and move laterally.
Detects scenarios where an attacker abuse the SeMachineAccountPrivilege which allows per default any authenticated user to join a computer to the domain. Later on, this computer account can be manipulated in order to elevate privileges.
Detects scenarios where an attacker modifies host delegation settings for privilege escalation.
Detects scenarios where an attacker creates a computer account with privileges for later exploitation.
Detects scenarios where an attacker modifies host delegation settings for privilege escalation.
Detects scenarios where an attacker set an account with password not required to perform privilege escalation attack.
Detects scenarios where an attacker removes security protection from a sensitive account to escalate privileges
Detects scenarios where an attacker enables a disabled builtin account.
Detects scenarios where an attacker reset or synchronize with another domain account the DSRM (Directory Services Restore Mode) password in order to escalate privileges.
Detects scenarios where an attacker grants new privileges on a SQL instance level
Detects scenarios where an attacker update the Service Principal Name (SPN) of a user account in order to enable Kerberoast attack and crack its password.
Detects scenarios where an attacker update the Service Principal Name (SPN) of a computer account in order to perform "Kerberos redirection" and escalate privileges.
Detects scenarios where an attacker adds his account to a server role (sysadmin, securityadmin, serveradmin, ...)
Detects scenarios where an attacker set an account with Kerberos pre-authentication not required to perform offline brutforce. Account with this status can be checked with the following command > "Get-ADUser -Filter 'useraccountcontrol -band 4194304' -Properties useraccountcontrol".
Detects scenarios where a suspicious group membership is changed. Having Microsoft LAPS installed may trigger false positive events for the builtin administrators group triggered by the system account (S-1-5-18).
Detects scenarios where an attacker resets a user account by using the compromised NTLM password hash. The newly clear text password defined by the attacker can be then used in order to login into services like Outlook Web Access (OWA), RDP, SharePoint... As ID 4723 refers to user changing is own password, the SubjectSid and TargetSid should be equal. However in a change initiated by Mimikatz, they will be different. Correlate the event ID 4723, 4624 and 5145 using the "SubjectLogonId" field to identify the source of the reset.
Detects scenarios where a suspicious group membership is changed.
Detects scenarios where an attacker enables a disabled builtin account via command line.
Page 30 of 40