Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
829 detections
Filters
Last updated
All Time
Detection languages
359
171
85
78
49
Contributors
249
169
139
40
32
Categories
329
229
130
111
109
Platforms
756
61
35
15
14
Products / Services
10,670
9,758
6,693
4,421
3,749
829
MITRE Techniques
238
233
203
189
94
CVEs
10
4
3
3
3
IDS Classtypes
8
7
3
2
1
IDS Protocols
10
4
3
3
2
Detects PowerShell activity where the 'Get-AdDefaultDomainPasswordPolicy' cmdlet is used to retrieve the default password policy for an Active Directory domain. This action can be performed by adversaries to understand password complexity requirements and account lockout policies, which can aid in planning brute-force or password-guessing attacks.
Detects reconnaissance activities targeting privileged Active Directory users or groups by monitoring Windows Security Event ID 4661. The rule specifically looks for access attempts to objects identified as privileged users or groups based on their Security Identifier (SID) suffixes or names containing 'admin'. It filters out activity from machine accounts to reduce false positives.
Detects attempts to modify the Discretionary Access Control List (DACL) of Active Directory objects, specifically looking for WRITE_DAC access (0x40000). This can indicate an adversary attempting to gain control over Active Directory objects, potentially for privilege escalation or persistence.
This rule detects the execution of 'adidnsdump' via 'python.exe'. Adidnsdump is a tool used for enumerating and exporting all DNS records in an Active Directory integrated DNS zone. This activity is typically performed for reconnaissance purposes within internal networks, allowing an attacker to gather information about the network's structure and resources by querying/modifying DNS records via LDAP.
Detects the execution of 'ntdsutil.exe' with command-line arguments indicating snapshot operations, specifically mounting a snapshot. This activity can be suspicious as 'ntdsutil.exe' is a legitimate Active Directory diagnostic tool that can be abused by adversaries to extract the NTDS.dit file, which contains sensitive credential information.
This rule detects the use of the 'Get-AdGroup' PowerShell cmdlet with the '-Filter' parameter to enumerate groups within Active Directory. This activity is often performed by attackers during the discovery phase to identify privileged groups and users.
Detects the execution of 'dsquery.exe' with command-line arguments indicative of domain trust discovery. This activity is often performed by adversaries to map out the network environment and identify potential lateral movement paths within multi-domain Active Directory environments.
Detects attempts to disable the runtime scanning of enabled macros in Microsoft Office by modifying the 'MacroRuntimeScanScope' registry key. This modification can be used by adversaries to bypass security features like AMSI (Antimalware Scan Interface) for VBA macros, allowing malicious macros to execute undetected.
Detects the execution of "ldifde.exe" to export Active Directory structure. This tool is often used by attackers to collect information about the domain for reconnaissance or exfiltration purposes. The rule specifically looks for the execution of ldifde.exe with the '-f' flag, which indicates an output file, while excluding the '-i' flag which is used for importing data.
Detects the execution of "ldifde.exe" in order to export organizational Active Directory structure.
Page 40 of 40