synoti logosynoti logo
Microsoft Windows

Detection rules for Windows Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.

This category lists 34 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
ADFS Authentication AnomaliesDefense Evasion, Persistence, Privilege Escalation, Initial AccessT1078 - Valid AccountsC:3 / I:2 / A:2
AS-REP Roasting Attack DetectionCredential AccessT1558.004 - Steal or Forge Kerberos Tickets: AS-REP RoastingC:3 / I:2 / A:1
AdminSDHolder Abuse DetectionPersistence, Privilege EscalationT1098 - Account ManipulationC:3 / I:3 / A:2
Certificate Services Abuse DetectionCredential AccessT1558 - Steal or Forge Kerberos TicketsC:3 / I:3 / A:1
Golden Ticket Attack DetectionCredential AccessT1558.001 - Steal or Forge Kerberos Tickets: Golden TicketC:3 / I:3 / A:3
Kerberoasting Attack DetectionCredential AccessT1558.003 - Steal or Forge Kerberos Tickets: KerberoastingC:3 / I:2 / A:1
NTDS.dit Extraction AttemptCredential AccessT1003.003 - OS Credential Dumping: NTDSC:3 / I:3 / A:1
NTLM Authentication Downgrade AttackDefense EvasionT1562.001 - Impair Defenses: Disable or Modify ToolsC:3 / I:3 / A:1
Pass-the-Hash Attack DetectionLateral MovementT1550.002 - Use Alternate Authentication Material: Pass the HashC:3 / I:3 / A:2
PowerShell Empire DetectionExecutionT1059.001 - Command and Scripting Interpreter: PowerShellC:3 / I:3 / A:2
Process Masquerading DetectionDefense EvasionT1036.005 - Masquerading: Match Legitimate Name or LocationC:2 / I:3 / A:2
RDP Brute Force AttackCredential AccessT1110.001 - Brute Force: Password GuessingC:3 / I:2 / A:2
SAM Database Access AttemptCredential AccessT1003.002 - OS Credential Dumping: Security Account ManagerC:3 / I:3 / A:1
SID History Injection AttemptDefense Evasion, Privilege EscalationT1134.005 - Access Token Manipulation: SID-History InjectionC:3 / I:3 / A:1
SMBv1 Usage DetectionLateral MovementT1210 - Exploitation of Remote ServicesC:3 / I:2 / A:2
Silver Ticket Attack DetectionCredential AccessT1558.002 - Steal or Forge Kerberos Tickets: Silver TicketC:3 / I:3 / A:2
Windows Remote Management (WinRM) AbuseLateral MovementT1021.006 - Remote Services: Windows Remote ManagementC:3 / I:3 / A:2
Windows audit log was clearedDefense EvasionT1070.001 - Indicator Removal: Clear Windows Event LogsC:1 / I:2 / A:3
Windows: LSASS Memory Dump Handle AccessCredential AccessT1003.001 - OS Credential Dumping: LSASS MemoryC:2 / I:3 / A:3
Windows: Multiple Logon Failure Followed by Logon SuccessCredential AccessT1110 - Brute ForceC:2 / I:2 / A:3
Windows: A new Windows service was created to launch from the Windows root directory. This is suspicious because the executable may have been placed through Windows Admin SharesExecutionT1021.002 - Remote Services: SMB/Windows Admin SharesC:1 / I:2 / A:3
Windows: Persistence via PowerShell profilePersistenceT1546.013 - Event Triggered Execution: PowerShell ProfileC:2 / I:3 / A:1
Windows: Possible Brute Force AttackCredential AccessT1110 - Brute ForceC:2 / I:2 / A:3
Windows: Potential ransomware attack identified. Several files deleted.ImpactT1486 - Data Encrypted for ImpactC:1 / I:3 / A:2
Windows: Potential ransomware attack identified. A ransomware note was created.ImpactT1486 - Data Encrypted for ImpactC:3 / I:3 / A:2
Windows: Potential ransomware attack identified. Atypical file extensions.ImpactT1486 - Data Encrypted for ImpactC:3 / I:3 / A:3
Windows: Printer driver failed to load, possible remote code execution using PrinterNightmare exploit: CVE-2021-34527Lateral MovementT1210 - Exploitation of Remote ServicesC:3 / I:2 / A:1
Windows: Remote File Download via Desktopimgdownldr UtilityCommand and ControlT1105 - Ingress Tool TransferC:2 / I:3 / A:1
Windows: Suspicious Print Spooler SPL File CreatedPrivilege EscalationT1068 - Exploitation for Privilege EscalationC:1 / I:3 / A:2
Windows: Suspicious PrintSpooler Service Executable File CreationPrivilege EscalationT1068 - Exploitation for Privilege EscalationC:2 / I:3 / A:1
Windows: UAC Bypass Attempt via Privileged IFileOperation COM InterfacePrivilege EscalationT1548.002 - Abuse Elevation Control Mechanism: Bypass User Account ControlC:1 / I:3 / A:2
Windows: Unusual File Modification by dns.exeLateral MovementT1210 - Exploitation of Remote ServicesC:1 / I:3 / A:2
Windows: Unusual Process Network ConnectionDefense EvasionTrusted Developer Utilities Proxy ExecutionC:3 / I:3 / A:2
Windows: User logged using Remote Desktop Connection from loopback address, possible exploit over reverse tunneling using stolen credentialsCredential AccessT1021.001 - Remote Services: Remote Desktop ProtocolC:3 / I:2 / A:1

Rule Example

Below is an example of a rule definition for ADFS Authentication Anomalies (view in repository):

# Rule version v1.0.0

dataTypes:
  - wineventlog
name: ADFS Authentication Anomalies
impact:
  confidentiality: 3
  integrity: 2
  availability: 2
category: Defense Evasion, Persistence, Privilege Escalation, Initial Access
technique: "T1078 - Valid Accounts"
adversary: origin
references:
  - https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/troubleshooting/ad-fs-tshoot-logging
  - https://attack.mitre.org/techniques/T1078/
description: |
  Detects anomalous authentication attempts against Active Directory Federation Services (ADFS) including multiple failed attempts that could indicate password spraying or brute force attacks. This rule monitors for authentication failures, token validation failures, and other ADFS security events that may indicate malicious activity.

  Next Steps:
  1. Review the source IP address and determine if it's from a known/trusted location
  2. Check for patterns of failed authentication attempts across multiple users
  3. Examine ADFS audit logs for additional context around the authentication failures
  4. Verify if the targeted user accounts are valid and active
  5. Consider implementing IP-based blocking if malicious activity is confirmed
  6. Review ADFS configuration for security hardening opportunities
  7. Correlate with other authentication events across the domain
where: equals("log.providerName", "AD FS") && (equals("log.eventId", "411") || equals("log.eventId", "342") || equals("log.eventId", "516")) && contains("log.message", "token validation failed")
afterEvents:
  - indexPattern: v1-7-22-log-wineventlog-*
    with:
      - field: origin.ip.keyword
        operator: filter_term
        value: '{{.origin.ip}}'
    within: now-10m
    count: 10
groupBy:
  - origin.ip
  - target.user

Rule Details

ADFS Authentication Anomalies

Identifies unusual authentication attempts targeting Active Directory Federation Services (ADFS), such as repeated failures that may point to password spraying or brute force attacks. This rule observes authentication failures, token validation failures, and other ADFS security events that could signal malicious activity.

AS-REP Roasting Attack Detection

Identifies AS-REP Roasting attacks that target accounts where Kerberos pre-authentication is disabled.
Attackers request AS-REP messages encrypted with RC4 (0x17) for accounts that do not require
pre-authentication, permitting offline password cracking. This acts as a companion technique to Kerberoasting
and focuses on a separate group of accounts at risk.

AdminSDHolder Abuse Detection

Identifies changes to the AdminSDHolder object, which can be used for persistence by assigning elevated privileges. Every 60 minutes, the SDProp process applies these permissions to protected groups, so this is a critical security event.

Certificate Services Abuse Detection

Identifies suspicious certificate requests and issuance that may point to Golden Certificate attacks or unauthorized certificate creation for persistence. This rule watches Windows Certificate Services events for potentially malicious certificate operations, especially those tied to machine accounts or anonymous logons that could be used for persistence and privilege escalation.

Golden Ticket Attack Detection

Detects Golden Ticket attacks where adversaries forge Kerberos TGTs using the KRBTGT account
hash, providing unrestricted domain access. The rule identifies unusual TGT usage patterns, including
TGS requests with unusual encryption types, tickets with abnormally long lifetimes, and Kerberos
authentication for the KRBTGT service from sources other than domain controllers.

Kerberoasting Attack Detection

Detects Kerberoasting attacks where adversaries request Kerberos TGS tickets encrypted with RC4 (0x17) for
service accounts to crack them offline and recover plaintext credentials. This is the most common
A technique for stealing Active Directory credentials observed in actual breaches. This rule tracks Event ID 4769
(Kerberos Service Ticket Operations) for RC4 encryption requests while excluding machine accounts (ending in $)
and authorized system services.

NTDS.dit Extraction Attempt

Identifies efforts to access or copy the Active Directory domain database (NTDS.dit), which holds password hashes for every domain user. This is a critical sign of credential theft attempts and possible domain compromise.

NTLM Authentication Downgrade Attack

Detects NTLM authentication downgrade attacks via registry modifications to LMCompatibilityLevel,
Threat actors alter the NtlmMinClientSec and NtlmMinServerSec registry entries to weaken NTLM.
authentication security, enabling credential interception, relay attacks, and offline cracking
of intercepted NTLM hashes. Lowering settings to LM or NTLMv1 authentication makes credential theft
significantly easier.

Pass-the-Hash Attack Detection

Detects Pass-the-Hash attacks by monitoring for NTLM authentication (Event ID 4624) with
LogonType 9 (NewCredentials) or LogonType 3 (Network) from unusual sources, combined with
the use of the Seclogon service. Attackers rely on stolen NTLM hashes to authenticate without
knowing the plaintext password, commonly through tools like Mimikatz sekurlsa::pth,
Impacket or CrackMapExec.

PowerShell Empire Detection

Identifies possible PowerShell Empire framework activity through distinctive command patterns, obfuscation methods, and encoded payloads often associated with this post-exploitation framework. PowerShell Empire is a post-exploitation framework that relies on PowerShell and Python agents to maintain persistence and run commands on compromised systems.

Process Masquerading Detection

Detects executables masquerading as legitimate Windows system processes but running from
wrong locations. For instance, svchost.exe should execute only from C:\Windows\System32,
and explorer.exe should execute only from C:\Windows. Malware often relies on legitimate process
names in an effort to evade detection by analysts and automated tools.

RDP Brute Force Attack

Identifies repeated unsuccessful RDP login attempts from the same source IP address, which may signal a brute force attack. This rule watches Windows Event ID 4625 (failed logon), focusing on network logon types (type 3) that are commonly used for RDP connections. It triggers when 10 or more failed attempts come from the same IP within 15 minutes.

SAM Database Access Attempt

Identifies efforts to access the Security Account Manager (SAM) database, which stores local user account hashes. Such activity can point to credential dumping, as attackers try to extract password hashes for offline cracking or lateral movement.

SID History Injection Attempt

Detects attempts to add SID History to an account, which can enable privilege escalation. SID History injection allows attackers to inherit permissions from privileged accounts without belonging to privileged groups. Both successful (4765) and failed (4766) attempts are tracked.

SMBv1 Usage Detection

Identifies use of the deprecated and vulnerable SMBv1 protocol, which could be exploited for lateral movement or ransomware propagation. SMBv1 is susceptible to many security vulnerabilities, including EternalBlue, and should be disabled in favor of SMBv2/SMBv3.

Silver Ticket Attack Detection

Detects Silver Ticket attacks where adversaries forge Kerberos TGS tickets using a service
the NTLM hash for an account, bypassing the KDC entirely. In contrast to Golden Tickets, Silver Tickets target
particular services. This rule flags TGS tickets that are submitted in the absence of matching TGT requests,
along with service access events that show abnormal Kerberos authentication patterns.

Windows Remote Management (WinRM) Abuse

Identifies possible abuse of Windows Remote Management (WinRM) for lateral movement. It monitors successful logon events (4624) with network logon type 3 combined with privilege escalation (4672) and WinRM-related process activity, suggesting remote command execution through WinRM.

Windows audit log was cleared

Identifies when the Windows audit log (Security event log) is cleared. Adversaries may clear event logs to erase evidence of an intrusion.

Windows: LSASS Memory Dump Handle Access

Detects handle requests for access to the Local Security Authority Subsystem Service (LSASS) object with particular access masks that many memory-dumping tools use (0x1fffff, 0x1010, 0x120089). This rule is not tied to any one tool, having been validated against a range of LSASS dump tools including SharpDump, Procdump, Mimikatz, Comsvcs, and so on. It identifies this behavior at a low level and does not rely on any specific tool or dump file name.

Windows: Multiple Logon Failure Followed by Logon Success

This rule triggers when multiple failed login attempts are followed immediately by a successful login from the same IP address or source. This unusual sequence of events may indicate a possible unauthorized access attempt using brute force or password guessing. The purpose of this rule is to identify suspicious login activity patterns and alert you to potential unauthorized access attempts.

Windows: A new Windows service was created to launch from the Windows root directory. This is suspicious because the executable may have been placed through Windows Admin Shares

Adversaries may leverage Valid Accounts to interact with a remote network share using Server Message Block (SMB). The adversary can then carry out actions as the logged-on user.

  • Category: Execution

  • Technique: T1021.002 - Remote Services: SMB/Windows Admin Shares

  • Impact: C:1 / I:2 / A:3

  • Rule file: suspicious_event_as_the_binary_may_have_been_dropped_using_windows_dmin_shares.yml

  • Reference: https://attack.mitre.org/techniques/T1021/002/

Windows: Persistence via PowerShell profile

Identifies creation or modification of a PowerShell profile. A PowerShell profile is a script executed when PowerShell starts to customize the user environment, and attackers can abuse it to persist in an environment where PowerShell is common.

Windows: Possible Brute Force Attack

This rule is triggered when repeated, rapid login attempts from the same IP address or source form a pattern. These login attempts may target particular user accounts or services to crack passwords via automated brute force. The rule aims to spot possible malicious unauthorized access attempts and stop a brute force attack against the system.

Windows: Potential ransomware attack identified. Several files deleted.

Detects possible ransomware activity by tracking multiple file write/modification events (Event ID 4663) with write access masks in user directories over a short period. Modern ransomware usually encrypts files in place instead of deleting them, so write access monitoring is more effective than deletion monitoring alone.

Windows: Potential ransomware attack identified. A ransomware note was created.

Ransomware is a form of malware that prevents users from accessing their system or personal files and requires a ransom payment before access can be restored. Detects ransomware attempts. A known ransomware note file has been found, which may signal an active ransomware infection.

Windows: Potential ransomware attack identified. Atypical file extensions.

Ransomware is a type of malware that stops users from accessing their system or personal files and requires a ransom payment before they can regain access. Detects ransomware attempts. Files with uncommon file extensions have been observed, which may point to encrypted files created by ransomware.

Windows: Printer driver failed to load, possible remote code execution using PrinterNightmare exploit: CVE-2021-34527

Adversaries may exploit remote services to gain unauthorized access to internal systems after they are inside a network. A software vulnerability is exploited when an adversary leverages a programming error in a program, service, or the operating system software or kernel itself to run adversary-controlled code. A common goal for post-compromise exploitation of remote services is lateral movement to enable access to a remote system.

  • Category: Lateral Movement

  • Technique: T1210 - Exploitation of Remote Services

  • Impact: C:3 / I:2 / A:1

  • Rule file: possible_remote_code_execution_using_printernightmare.yml

  • Reference: https://attack.mitre.org/techniques/T1210/

Windows: Remote File Download via Desktopimgdownldr Utility

Identifies use of the desktopimgdownldr utility to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files rather than certutil.

Windows: Suspicious Print Spooler SPL File Created

Detects attempts to exploit privilege escalation flaws tied to the Print Spooler service, including CVE-2020-1048 and CVE-2020-1337.

Windows: Suspicious PrintSpooler Service Executable File Creation

Detects efforts to exploit privilege escalation flaws tied to the Print Spooler service. For details, see these CVEs: CVE-2020-1048, CVE-2020-1337, and CVE-2020-1300, and confirm that the affected system is patched.

Windows: UAC Bypass Attempt via Privileged IFileOperation COM Interface

Detects attempts to circumvent User Account Control (UAC) through DLL side-loading. Adversaries may try to bypass UAC so they can quietly run code with elevated rights.

Windows: Unusual File Modification by dns.exe

Detects when dns.exe, the process behind Windows DNS Server services, modifies a file unexpectedly, which could signal remote code execution or another type of exploitation.

Windows: Unusual Process Network Connection

Detects network traffic from system applications that are not expected. This could point to adversary activity, since these applications are frequently used by adversaries to run code and avoid detection.

Windows: User logged using Remote Desktop Connection from loopback address, possible exploit over reverse tunneling using stolen credentials

Adversaries may leverage Valid Accounts to sign in to a computer through the Remote Desktop Protocol (RDP). The adversary may then carry out actions as the logged-on user.

  • Category: Credential Access

  • Technique: T1021.001 - Remote Services: Remote Desktop Protocol

  • Impact: C:3 / I:2 / A:1

  • Rule file: possible_exploit_over_reverse_tunneling_using_stolen_credentials.yml

  • Reference: https://attack.mitre.org/techniques/T1021/001/