Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
197 detections
Filters
Last updated
All Time
Detection languages
71
49
23
23
11
Contributors
49
39
31
20
14
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
177
18
2
2
2
Products / Services
94
34
26
26
23
MITRE Techniques
114
83
32
32
25
CVEs
3
2
2
1
1
IDS Classtypes
11
4
3
3
1
IDS Protocols
12
10
Detects the use of the Windows net.exe or net1.exe utility to query network shares or session information, which is a common technique used by attackers for internal reconnaissance and network discovery.
Detects an abnormally high volume of connections to the hidden IPC$ administrative share on a Windows host within a short time window. This activity is often associated with lateral movement techniques, scanning, or brute-forcing attempts where adversaries interact with SMB shares for reconnaissance or remote execution.
This rule detects potential internal network reconnaissance activities by monitoring for either mass execution of network discovery commands (such as 'net view' or 'net share') targeting multiple unique hosts within a 5-minute window, or by monitoring for mass outbound network connections to port 445 (SMB) across multiple unique destination hosts within the same timeframe. This behavior is indicative of an attacker attempting to map available network shares or identify reachable systems for lateral movement.
This rule detects the execution of Impacket toolkit modules (such as psexec.py, wmiexec.py, secretsdump.py) via EDR process events, as well as potential lateral movement patterns identified by NTLM authentication (Logon Type 3) to ADMIN$ or IPC$ shares. This combination of signals is indicative of credential dumping, remote service execution, or lateral movement using techniques often employed by the Impacket suite.
This rule detects the creation or modification of executable files (.exe or .dll) on hidden Windows administrative shares (e.g., ADMIN$, C$, D$, IPC$), followed by the execution of a process with the same file hash on a different host within a one-hour window. This behavior is indicative of lateral movement using SMB shares to stage and execute malicious payloads.
Detects network traffic over SMB targeting the SYSVOL or NETLOGON network shares that includes the transfer or reference of common executable file extensions. This behavior is indicative of an adversary attempting to stage malicious payloads for deployment via Group Policy Objects (GPOs), a common method for lateral movement and persistence.
Detects network traffic over SMB targeting the SYSVOL or NETLOGON network shares that includes the transfer or reference of common executable file extensions. This behavior is indicative of an adversary attempting to stage malicious payloads for deployment via Group Policy Objects (GPOs), a common method for lateral movement and persistence.
This rule detects the use of the PSEXESVC named pipe during a write operation over the SMB protocol, which is indicative of lateral movement using the PsExec tool.
This rule detects a high volume of access attempts to the IPC$ administrative share from a single source IP address within a one-hour window. This behavior can be indicative of reconnaissance, lateral movement, or other malicious activities using SMB/Windows Admin Shares.
Detects evidence of common Impacket tool execution (e.g., psexec, wmiexec, smbexec, ntlmrelayx), unauthorized access to sensitive SMB administrative shares (ADMIN$, IPC$), creation of suspicious services often used for remote execution, and lateral movement via NTLM network logons.
This rule detects the execution of common network share enumeration tools or scripts, specifically looking for the execution of netscan.exe (or similar) or PowerShell commands utilizing common share finding utilities like Invoke-ShareFinder, CheckShareAccess, or commands exporting share information to files.
Detects remote SMB access (Event ID 5145) to sensitive file paths where credentials are commonly stored, including DPAPI master keys, browser profiles, cloud provider configuration directories, and password manager data. This activity often indicates unauthorized credential discovery and staging during lateral movement or post-compromise reconnaissance.
This rule detects suspicious activity related to high-volume Server Message Block (SMB) share enumeration and the execution of a specific Python script named 'backup_dfs.py'. It combines three detection logics: identifying processes executing 'backup_dfs.py', detecting an unusual number of SMB network connections to common administrative shares (SYSVOL, NETLOGON, DFS), and flagging high-volume SMB-related identity directory events targeting SYSVOL or NETLOGON. This behavior could indicate an adversary performing discovery of network shares, collecting data, or preparing for data exfiltration.
Detects the use of 'net.exe' or 'net1.exe' with arguments 'view', 'share', or 'use' that appear in rapid succession or are initiated by potentially suspicious parent processes. This behavior is often associated with network enumeration and reconnaissance activities.
Detects the use of 'net.exe' or 'net1.exe' with arguments 'view', 'share', or 'use' that appear in rapid succession or are initiated by potentially suspicious parent processes. This behavior is often associated with network enumeration and reconnaissance activities.
This rule detects potential lateral movement activity by identifying devices that establish connections to three or more distinct remote IP addresses via SMB/CIFS ports (445 or 139) within a one-hour window. The query excludes internal network ranges (10.x.x.x and 192.168.x.x) to focus on connections that may be traversing network boundaries or reaching out to segments that might indicate unauthorized discovery or movement.
This rule detects suspicious activity related to high-volume Server Message Block (SMB) share enumeration and the execution of a specific Python script named 'backup_dfs.py'. It combines three detection logics: identifying processes executing 'backup_dfs.py', detecting an unusual number of SMB network connections to common administrative shares (SYSVOL, NETLOGON, DFS), and flagging high-volume SMB-related identity directory events targeting SYSVOL or NETLOGON. This behavior could indicate an adversary performing discovery of network shares, collecting data, or preparing for data exfiltration.
Detects creation or restoration of ADMIN$, C$, or custom hidden shares used for remote ransomware deployment. This rule specifically looks for `net.exe`, `powershell.exe`, or `cmd.exe` executing commands that create or modify SMB shares, targeting administrative shares like ADMIN$, C$, or any share ending with a dollar sign ($).
This rule detects potential lateral movement activity by identifying devices that establish connections to three or more distinct remote IP addresses via SMB/CIFS ports (445 or 139) within a one-hour window. The query excludes internal network ranges (10.x.x.x and 192.168.x.x) to focus on connections that may be traversing network boundaries or reaching out to segments that might indicate unauthorized discovery or movement.
Detects network share enumeration commands executed inside a remote desktop session, matching post-access discovery of mapped corporate storage. This rule specifically looks for commands like 'net use', 'net view', PowerShell cmdlets such as 'Get-SmbShare', 'Get-PSDrive', 'Get-SmbMapping', WMI queries for 'Win32_LogicalDisk', or UNC path references ('\\') executed via 'cmd.exe', 'powershell.exe', 'pwsh.exe', 'net.exe', or 'net1.exe' within a remote session.
This rule detects multiple access attempts to administrative SMB shares (C$, D$, E$, ADMIN$, IPC$) from a single source IP address within a 5-minute window. This behavior can be indicative of lateral movement, reconnaissance, or ransomware activity attempting to spread across a network by accessing critical shares.
Page 5 of 10