Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
229 detections
Filters
Last updated
All Time
Detection languages
92
56
25
20
16
Contributors
63
54
46
21
14
Categories
149
139
35
33
32
Platforms
197
22
7
4
3
Products / Services
10,683
9,759
6,695
4,421
3,750
229
MITRE Techniques
105
80
49
33
31
CVEs
3
3
3
2
1
IDS Classtypes
12
2
1
1
IDS Protocols
9
7
Detects multiple failed Kerberos pre-authentication attempts (EventID 4771 with status codes 0x18 or 0x1f) from a single IP address against a target user within a short timeframe (20 attempts in 5 minutes). This pattern is indicative of a brute-force attack against Kerberos accounts.
This rule detects potential Kerberos authentication abuse related to cross-domain trusts. It specifically looks for TCP traffic on port 88 (Kerberos) to the home network, containing the byte '6b' at the first position of the payload. A threshold of 20 occurrences within 10 seconds from the same source IP is set to trigger an alert, indicating a potential brute-force or rapid authentication attempt.
This rule detects Kerberos Pass-the-Ticket attacks where a Ticket Granting Service (TGS) request contains a forged Privilege Attribute Certificate (PAC). This is identified by specific byte sequences in UDP traffic on port 88, which is commonly used for Kerberos.
This rule detects an AS-REP Roasting attack where pre-authentication is not required. It specifically looks for UDP traffic on port 88 (Kerberos) containing specific byte sequences associated with this attack technique. The rule uses a threshold to prevent excessive alerts from a single source.
This rule detects a specific type of Kerberos AS-REQ (Authentication Service Request) that lacks pre-authentication, which is characteristic of a 'Golden Ticket' attack (ATT&CK T1558.001). The rule specifically looks for UDP traffic on port 88 (Kerberos default port) to the home network, containing the byte sequences '|30|' and '|a1 03 02 01 05|'. These content checks are indicative of the structure of a Kerberos AS-REQ packet without the expected pre-authentication data.
Detects multiple failed Kerberos pre-authentication attempts (EventID 4771 with status codes 0x18 or 0x1f) from a single IP address against a target user within a short timeframe (20 attempts in 5 minutes). This pattern is indicative of a brute-force attack against Kerberos accounts.
This rule detects potential Kerberoasting attacks by identifying a high number of Kerberos Ticket-Granting Service (TGS) requests (EventID 4769) for Service Principal Names (SPNs) that are encrypted with RC4 (indicated by TicketOptions containing '0x40810000'). A threshold of 15 or more TGS requests from a single IP address for a target user is used to flag suspicious activity.
This rule detects an anomaly in Kerberos authentication attempts by monitoring TCP traffic to port 88 (Kerberos). It triggers an alert if a source IP address attempts Kerberos authentication 30 or more times within a 10-second window, indicating a potential brute-force or rapid authentication attempt against a domain account.
This rule detects unauthorized Kerberos service ticket requests directed at a Domain Controller (DC). It specifically looks for TCP traffic to port 88 (Kerberos) on the home network, with a content match for the byte sequence '|6b|' at the beginning of the payload. A threshold of 50 requests within 10 seconds from the same source IP triggers the alert, indicating a potential brute-force or enumeration attempt against Kerberos services.
This rule detects network traffic to port 88 (Kerberos) that exhibits characteristics of a vulnerability exploit for credential access. Specifically, it triggers an alert if there are 30 or more TCP connections to port 88 on the HOME_NET within a 5-second window from a single source IP address, indicating a potential brute-force or rapid credential access attempt against a Kerberos service.
Kerberos Realm Trust Discovery
Suricata
This rule detects Kerberos Realm Trust Discovery attempts by looking for specific byte patterns in TCP traffic destined for port 88 (Kerberos). The rule triggers if the byte sequence "6b 82" is found within the first 2 bytes of the payload. A threshold is applied to prevent excessive alerts, triggering if 10 such events occur from the same source within 30 seconds.
This Suricata rule detects Kerberos unconstrained delegation abuse by looking for a specific byte sequence in UDP traffic destined for port 88 (Kerberos). The byte sequence '|a0 03 02 01 05 a1 03 02 01 0d|' is indicative of a specific Kerberos message structure that can be associated with unconstrained delegation. Unconstrained delegation allows a service to impersonate any user to any other service on the network, which can be abused by attackers for privilege escalation and lateral movement.
This rule detects an anomaly in Kerberos Ticket Granting Ticket (TGT) requests. Specifically, it triggers an alert if more than 50 UDP Kerberos TGT requests are observed from a single source IP address within a 10-second window to the home network on port 88. This behavior could indicate an attempt to enumerate valid user accounts or perform credential stuffing/brute-force attacks against the Kerberos authentication system, potentially as part of a privilege escalation attempt (ATT&CK T1134).
Detects modifications to the msDS-KeyCredentialLink attribute on Delegated Managed Service Account (dMSA) objects, indicating a potential Shadow Credential (X.509 certificate) planting. This allows an attacker to bypass managed password rotation and maintain permanent PKINIT access, as seen in the dMSA Ouroboros attack chain. The rule also monitors Event 4768 (PKINIT TGT requests with pre-authentication type 17) and Event 4662 (S4U2Self Object Access) for dMSA objects, which are key indicators of this attack.
This rule detects potential Kerberoasting activity by identifying an unusual number of Kerberos service ticket requests (Event ID 4769) for service principal names (SPNs) ending with '$' from a single client address within an hour. A high count (over 10) is flagged as 'High' suspicion, while a count between 5 and 10 is flagged as 'Medium'. This behavior is indicative of an attacker attempting to obtain service ticket hashes for offline cracking.
This rule detects a correlated attack chain involving LDAP Service Principal Name (SPN) enumeration followed by Kerberoasting activity. It identifies an actor performing LDAP queries for SPNs, then links that actor to subsequent Kerberos Ticket-Granting Service (TGS) requests for those service accounts within a defined time window. The rule specifically looks for a minimum number of unique service accounts targeted to trigger an alert, indicating a potential Kerberoasting attack.
Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account. This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.
This rule detects uncommon outbound network connections on TCP port 88, which is the default port for Kerberos. Such activity, especially from processes other than expected system services like LSASS or common applications like web browsers and Tomcat, can indicate potential lateral movement or initial privilege escalation attempts through Kerberos delegation. Attackers often leverage Kerberos for authentication in Windows environments to move between systems or elevate privileges, for example, using tools like Rubeus for Kerberoasting or other Kerberos-based attacks.
The following analytic detects the use of default or publicly known named pipes associated with Cobalt Strike. It leverages Sysmon EventID 17 and 18 to identify specific named pipes commonly used by Cobalt Strike's Artifact Kit and Malleable C2 Profiles. This activity is significant because Cobalt Strike is a popular tool for adversaries to conduct post-exploitation tasks, and identifying its named pipes can reveal potential malicious activity. If confirmed malicious, this could indicate an active Cobalt Strike beacon, leading to unauthorized access, data exfiltration, or further lateral movement within the network.
This analytic detects suspicious data transfer activities involving the use of the `split` syscall with the `-b` option, which specifies the size of each output file. This technique can be used by attackers to evade detection by breaking large files into smaller parts, bypassing size-based security controls, and facilitating covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall with a specified block size, this analytic helps identify potential data exfiltration attempts.
This analytic identifies the bulk creation of ransomware notes (e.g., .txt, .html, .hta files) on an infected machine. It leverages Sysmon EventCode 11 to detect multiple instances of these file types being created within a short time frame (10 seconds). A detection is triggered if 15 or more unique readme paths are observed. This activity is a strong indicator of an active ransomware attack, where the attacker is notifying the victim of the encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering critical files inaccessible and potentially causing significant operational disruption.
Page 8 of 11