Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
197 detections
Filters
Last updated
All Time
Detection languages
71
49
23
23
11
Contributors
49
39
31
20
14
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
177
18
2
2
2
Products / Services
94
34
26
26
23
MITRE Techniques
114
83
32
32
25
CVEs
3
2
2
1
1
IDS Classtypes
11
4
3
3
1
IDS Protocols
12
10
Detects a host initiating rapid sequential SMB tree connections to more than 10 distinct remote hosts within a 5-minute window. This behavior is indicative of network reconnaissance, specifically the enumeration of accessible SMB shares, which is a common precursor to lateral movement and large-scale ransomware encryption activity as observed in DragonForce-related incidents.
Detects the use of the Windows 'net' or 'net1' utility to connect to the hidden 'IPC$' inter-process communication share. This behavior is often associated with lateral movement, reconnaissance, or establishing authenticated sessions to remote systems for further malicious activity, such as remote command execution.
Detects the placement of potentially malicious executable or script files onto a network share followed by the execution of that specific file path from a different host within a short timeframe. This behavior is indicative of lateral movement using tainted shared content.
Detects the placement of potentially malicious executable or script files onto a network share followed by the execution of that specific file path from a different host within a short timeframe. This behavior is indicative of lateral movement using tainted shared content.
This rule detects potential lateral movement activity by identifying executable or script files being written to administrative shares (C$ or ADMIN$) followed by the execution of a file with the same name on the destination device within 15 minutes. It includes logic to filter out known deployment/patch management service accounts and file names to reduce noise.
This rule detects potential lateral movement activity by identifying executable or script files being written to administrative shares (C$ or ADMIN$) followed by the execution of a file with the same name on the destination device within 15 minutes. It includes logic to filter out known deployment/patch management service accounts and file names to reduce noise.
Detects the placement of potentially malicious executable or script files onto a network share followed by the execution of that specific file path from a different host within a short timeframe. This behavior is indicative of lateral movement using tainted shared content.
This rule detects potential lateral movement activity by identifying executable or script files being written to administrative shares (C$ or ADMIN$) followed by the execution of a file with the same name on the destination device within 15 minutes. It includes logic to filter out known deployment/patch management service accounts and file names to reduce noise.
This rule detects potential lateral movement activity by identifying executable or script files being written to administrative shares (C$ or ADMIN$) followed by the execution of a file with the same name on the destination device within 15 minutes. It includes logic to filter out known deployment/patch management service accounts and file names to reduce noise.
This rule detects potential lateral movement activity by identifying executable or script files being written to administrative shares (C$ or ADMIN$) followed by the execution of a file with the same name on the destination device within 15 minutes. It includes logic to filter out known deployment/patch management service accounts and file names to reduce noise.
Detects the placement of potentially malicious executable or script files onto a network share followed by the execution of that specific file path from a different host within a short timeframe. This behavior is indicative of lateral movement using tainted shared content.
Detects the placement of potentially malicious executable or script files onto a network share followed by the execution of that specific file path from a different host within a short timeframe. This behavior is indicative of lateral movement using tainted shared content.
Detects potential lateral movement by identifying the creation or modification of a file named 'fsociety.exe' on sensitive Windows administrative shares (ADMIN$ or C$). This behavior is consistent with the TOKYOCORE worm-like threat activity, where malicious binaries are replicated across the network.
Detects the use of the 'pushd' command in combination with a WebDAV share path utilizing the '@SSL' notation. This technique can be used by attackers to force the connection to a remote WebDAV share, potentially triggering NTLM credential relay or accessing malicious remote resources. The inclusion of 'rundll32' in the condition suggests monitoring for process proxying or exploitation chains often associated with such connections.
Detects the use of the 'pushd' command in combination with a WebDAV share path utilizing the '@SSL' notation. This technique can be used by attackers to force the connection to a remote WebDAV share, potentially triggering NTLM credential relay or accessing malicious remote resources. The inclusion of 'rundll32' in the condition suggests monitoring for process proxying or exploitation chains often associated with such connections.
Detects the execution of 'net use' commands targeting administrative shares (C$ or ADMIN$) on Windows systems. This behavior is frequently associated with lateral movement, where an adversary attempts to connect to remote file shares using administrative credentials to move files or execute malicious payloads.
Detects the use of the 'pushd' command in combination with a WebDAV share path utilizing the '@SSL' notation. This technique can be used by attackers to force the connection to a remote WebDAV share, potentially triggering NTLM credential relay or accessing malicious remote resources. The inclusion of 'rundll32' in the condition suggests monitoring for process proxying or exploitation chains often associated with such connections.
Detects the use of the Windows 'net use' utility to mount a C$ administrative share using explicit user credentials. This behavior is commonly associated with lateral movement techniques where an adversary attempts to connect to a remote system share to gain access, transfer files, or execute binaries.
This rule detects suspicious access patterns to Windows administrative shares (C$, D$, E$, IPC$, ADMIN$). It specifically looks for multiple access attempts (10 or more within an hour) involving read or write operations (AccessMask contains '0x0001' or '0x0002') from a single source IP address and account. This behavior can indicate lateral movement, data exfiltration, or other malicious activity.
Detects the use of 'pushd' via cmd.exe, powershell.exe, or pwsh.exe to mount remote UNC or WebDAV paths. This command allows users to map a network share to a temporary drive letter and change the current working directory, which is frequently used by adversaries to access remote shares or stage tools.
Detects the use of the 'net.exe' or 'net1.exe' command-line utilities to mount a local SMB share using loopback addresses (127.0.0.1 or localhost) with the '/tcpport' argument. This pattern is indicative of attempts to exploit CVE-2026-24294 to bypass NTLM authentication protections through local reflection or relay attacks.
Page 3 of 10