Lacey Cochrane
@NullVectorXUSTrusted contributorCompletionist
11 followers159 downloads2,514 copies56 likes67,916 views
245 detections
Filters
Last updated
All Time
Detection languages
245
Categories
73
66
54
29
29
Platforms
83
58
36
26
24
Products / Services
35
26
23
21
19
MITRE Techniques
79
70
46
44
42
CVEs
4
4
Detects remote registry operations performed through the Winreg RPC interface. This behavior is commonly associated with adversary tools like secretsdump used to extract sensitive Windows registry hives such as SAM, SECURITY, and SYSTEM. Monitoring remote registry access is crucial for identifying unauthorized data collection and credential access attempts.
Detects Kerberos Ticket Granting Service (TGS) requests (Event ID 4769) that use RC4 encryption (0x17). In modern Active Directory environments, RC4 is considered weak and is often explicitly requested by attackers during Kerberoasting to facilitate offline brute-force cracking of service account passwords. The rule excludes common service accounts (e.g., krbtgt, machine accounts) to reduce noise.
Detects remote command execution using WMI by monitoring RPC calls to the IWbemServices interface (UUID {9556DC99-828C-11CF-A37E-00AA003240C7}). The rule specifically targets the ExecMethod operation (opnum 24) commonly used by tools like Impacket's wmiexec to execute Win32_Process.Create on remote targets. Filter for COMSPEC to increase fidelity for detecting wmiexec.
Kerberos TGT Request Anomaly Detection
Cortex XDR
This rule detects potential indicators of forged Kerberos Ticket Granting Tickets (Golden Tickets). It monitors Kerberos authentication events (4768 and 4769) for specific anomalies, including ticket requests for non-existent accounts (Status 0x6), suspicious service requests (krbtgt with RC4 encryption), and abnormal ticket option usage, which are common artifacts of credential manipulation and forgery.
Detects remote file access (via SMB, named pipes, or TCP) to the Active Directory Certificate Services (AD CS) 'CertLog' directory. This directory contains the CA database (.edb), which holds issued certificates and archived private keys. Access to these files from a non-CA host is a strong indicator of an attempt to exfiltrate the CA database for offline certificate and private key recovery.
AS-REP Roasting Potential Enumeration
Cortex XDR
Detects Kerberos AS-REQ events (Event ID 4768) where accounts with Kerberos pre-authentication disabled successfully request an AS-REP ticket. Attackers exploit these accounts by requesting encrypted AS-REP blobs to perform offline password cracking. The rule flags potential enumeration when multiple unique accounts are targeted from the same source within a short timeframe.
This rule detects instances where Google Workspace flags a sensitive action as risky (such as sign-ins from suspicious locations, unusual devices, or known-bad IPs), yet the action is allowed to proceed. This indicates a potential bypass of security controls or an account compromise where an adversary is utilizing a valid account despite triggered risk indicators.
Detects unauthorized attempts to exercise Active Directory replication rights (DS-Replication-Get-Changes). This occurs when non-machine accounts access specific control access rights (GUIDs 1131f6aa, 1131f6ad, or 89e95b76) on a domain controller, a common indicator of a DCSync attack used to extract password hashes from Active Directory.
Detects a potential Kerberoasting attempt by identifying a single user or IP requesting multiple RC4-encrypted Ticket Granting Service (TGS) tickets for distinct service accounts within a short timeframe. Kerberoasting involves requesting TGS tickets for service accounts, which are then used for offline brute-force cracking of the service account's password hash.
Detects the addition of a 'msDS-KeyCredentialLink' attribute to an Active Directory object (Event 5136), which is indicative of the Shadow Credentials attack vector, followed by a successful PKINIT authentication (Event 4768) for that account. This combination suggests that an adversary has successfully established persistent access using a forged or unauthorized device credential and is now utilizing it for authentication.
Page 6 of 25