Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
197 detections
Filters
Last updated
All Time
Detection languages
71
49
23
23
11
Contributors
49
39
31
20
14
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
177
18
2
2
2
Products / Services
94
34
26
26
23
MITRE Techniques
114
83
32
32
25
CVEs
3
2
2
1
1
IDS Classtypes
11
4
3
3
1
IDS Protocols
12
10
Detects files transferred with a visibility or ownership change on the MFT platform.
Widening who can retrieve a file is the quietest possible exfiltration route: the
data never leaves the platform in a way the network would notice, it simply becomes
reachable by someone new.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=documents where sourcename='GOANYWHERE-MFT'
| groupby user, targetuser, file, filetype, visibility, owner
Widening who can retrieve a file is the quietest possible exfiltration route: the
data never leaves the platform in a way the network would notice, it simply becomes
reachable by someone new.
Onboarding: GOANYWHERE-MFT is ingested via Syslog (Bloo extractor 850).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=documents where sourcename='GOANYWHERE-MFT'
| groupby user, targetuser, file, filetype, visibility, owner
Detects extensive file access on the NAS from a source address without prior
history. Shared storage holds concentrated value, and bulk reads from an unfamiliar
origin is the reconnaissance-then-collection pattern applied to a file share.
Onboarding: DISKSTATION-NAS is ingested via Syslog (Bloo extractor 826).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=documents where sourcename='DISKSTATION-NAS' and action='ACCESSED'
| duration 1h
| groupby srcip, user
| select srcip, user, distinct_count(file)
| having distinct_count_col1 > 100
history. Shared storage holds concentrated value, and bulk reads from an unfamiliar
origin is the reconnaissance-then-collection pattern applied to a file share.
Onboarding: DISKSTATION-NAS is ingested via Syslog (Bloo extractor 826).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=documents where sourcename='DISKSTATION-NAS' and action='ACCESSED'
| duration 1h
| groupby srcip, user
| select srcip, user, distinct_count(file)
| having distinct_count_col1 > 100
The following analytic identifies network share discovery and collection activities performed on Windows systems using the Net command. Attackers often use network share discovery to identify accessible shared resources within a network, which can be a precursor to privilege escalation or data exfiltration. By monitoring Windows Event Logs for the usage of the Net command to list and interact with network shares, this detection helps identify potential reconnaissance and collection activities.
The following analytic detects the creation of an NTFS alternate data stream (ADS) accessed over a local administrative share targeting the loopback address (127.0.0.1).
It leverages Windows Security Event Logs with EventCode 5145 to identify this activity.
Legitimate local processes access files directly rather than through a local SMB share.
This behavior is a hallmark of the ShieldBreak exploit, which abuses a symbolic link swap through a loopback share to redirect a privileged, Defender-driven write into an alternate data stream on a system-owned file, ultimately landing attacker content in C:\Windows\System32.
If confirmed malicious, this activity indicates an in-progress local privilege escalation attempt and should be investigated immediately.
It leverages Windows Security Event Logs with EventCode 5145 to identify this activity.
Legitimate local processes access files directly rather than through a local SMB share.
This behavior is a hallmark of the ShieldBreak exploit, which abuses a symbolic link swap through a loopback share to redirect a privileged, Defender-driven write into an alternate data stream on a system-owned file, ultimately landing attacker content in C:\Windows\System32.
If confirmed malicious, this activity indicates an in-progress local privilege escalation attempt and should be investigated immediately.
The following analytic detects the creation or deletion of Windows shares using the net.exe command. It leverages Endpoint Detection and Response (EDR) data to identify processes involving net.exe with actions related to share management. This activity is significant because it may indicate an attacker attempting to manipulate network shares for malicious purposes, such as data exfiltration, malware distribution, or establishing persistence. If confirmed malicious, this activity could lead to unauthorized access to sensitive information, service disruption, or malware introduction. Immediate investigation is required to determine the intent and mitigate potential threats.
The following analytic detects access to Windows administrative SMB shares (Admin$, IPC$, C$) using the 'dir' command. It leverages Windows Security Event Logs with EventCode 5140 to identify this activity.
This behavior is significant as it is commonly used by tools like PsExec/PaExec for staging binaries before creating and starting services on remote endpoints, a technique often employed by adversaries for lateral movement and remote code execution.
If confirmed malicious, this activity could allow attackers to propagate malware, such as IcedID, across the network, leading to widespread infection and potential data breaches.
This behavior is significant as it is commonly used by tools like PsExec/PaExec for staging binaries before creating and starting services on remote endpoints, a technique often employed by adversaries for lateral movement and remote code execution.
If confirmed malicious, this activity could allow attackers to propagate malware, such as IcedID, across the network, leading to widespread infection and potential data breaches.
Detects multiple attempts to connect to administrative shares (ADMIN$, C$, IPC$) from a single source within a 60-second window. This pattern is indicative of automated lateral movement or enumeration attempts using the SMB protocol.
Detects potential lateral movement by identifying NTLM authentication (Logon Type 3) to administrative network shares (ADMIN$, C$, IPC$) or high-frequency access to multiple hosts by the same user, which may indicate credential abuse or lateral movement attempts.
Detects anomalous lateral movement behavior where a user account authenticates via NTLM (Logon Type 3) to at least three different hosts within a 10-minute window and subsequently accesses administrative network shares (ADMIN$ or C$) on one or more of those target systems.
Detects potential lateral movement by users who have recently been flagged for credential theft or infostealer activity. The rule correlates initial security alerts with subsequent Windows logon events (RDP, network/WinRM) or SMB share access, identifying users connecting to multiple distinct destinations within a 48-hour window.
Detects the creation of suspicious Windows services associated with remote execution tools like PsExec, PAExec, or custom tools that leverage SMB administrative shares (ADMIN$, IPC$). The rule correlates the service creation event (Event ID 7045, 4697) with preceding network connection attempts to SMB shares, and subsequent service termination or state change events within a short timeframe, which is a pattern characteristic of remote lateral movement and command execution.
This rule detects potential lateral movement indicative of PsExec or similar administrative tools. It identifies the combination of remote service installation (often using ADMIN$ or Temp paths), access to administrative shares (ADMIN$ or C$), and the execution of a process spawned by services.exe, which is characteristic of the remote service control manager performing remote service starts.
Detects lateral movement patterns associated with PsExec or its variants. The rule correlates SMB administrative share access (ADMIN$ or IPC$), the subsequent installation of a service (often named PSEXESVC or using a temporary executable path), and the immediate execution of a command or shell (cmd.exe or powershell.exe) by that service.
Detects the use of Mimikatz 'sekurlsa::pth' command for credential manipulation, or the occurrence of SMB/Windows administrative share access (ADMIN$, C$) potentially indicating lateral movement activities.
Detects the creation or writing of executable binary files (e.g., .exe, .dll, .bat, .ps1, .vbs, .scr) to sensitive Windows administrative shares (ADMIN$, C$, IPC$) via SMB. This behavior is indicative of lateral movement where an attacker attempts to stage tools or scripts on a remote system for subsequent execution.
Detects Impacket-style hands-on-keyboard staging: a NeedyMantis bundle file dropped by cmd.exe/wmiprvse.exe/services.exe carrying the distinctive remote-execution fingerprint (ADMIN$ share reference, %COMSPEC% invocation, or 2>&1 output redirection used by wmiexec/smbexec/atexec), followed within 15 minutes by execution referencing the same bundle folder with the same fingerprint. Requiring the ADMIN$/%COMSPEC%/redirection fingerprint on both the copy and the execution -- rather than just matching on common process names like cmd.exe or svchost.exe -- removes the bulk of ordinary software installation and update activity that also uses cmd.exe to stage files.
Detects Impacket-style hands-on-keyboard staging: a NeedyMantis bundle file dropped by cmd.exe/wmiprvse.exe/services.exe carrying the distinctive remote-execution fingerprint (ADMIN$ share reference, %COMSPEC% invocation, or 2>&1 output redirection used by wmiexec/smbexec/atexec), followed within 15 minutes by execution referencing the same bundle folder with the same fingerprint. Requiring the ADMIN$/%COMSPEC%/redirection fingerprint on both the copy and the execution -- rather than just matching on common process names like cmd.exe or svchost.exe -- removes the bulk of ordinary software installation and update activity that also uses cmd.exe to stage files.
Detects potential lateral movement by identifying NTLM authentication (Logon Type 3) to administrative network shares (ADMIN$, C$, IPC$) or high-frequency access to multiple hosts by the same user, which may indicate credential abuse or lateral movement attempts.
Detects the creation of suspicious services that are preceded by an administrative SMB share (ADMIN$) connection and a network logon event (Type 3) from the same source. This pattern is commonly used by lateral movement tools (like PsExec) to execute payloads remotely by installing a service, accessing the administrative share to drop the binary, and executing the service.
This rule detects potential lateral movement activity by identifying the execution of PsExec service components or common lateral movement tools (PsExec, WMIC, CMD) interacting with Windows administrative shares (via UNC paths or specific network ports 135, 139, 445). It specifically looks for process creation events associated with these tools and network activity indicative of remote administration. Legitimate administrative tools signed by Microsoft or known management software (SolarWinds, Tanium, Ivanti, IBM BigFix) are explicitly excluded.
Detects NTLM authentication attempts targeting administrative network shares (ADMIN$ or C$) over the SMB protocol. This behavior is a common indicator of lateral movement techniques such as Pass-the-Hash, where an adversary uses captured NTLM hashes to authenticate to remote systems.
Page 1 of 10