Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
197 detections
Filters
Last updated
All Time
Detection languages
71
49
23
23
11
Contributors
49
39
31
20
14
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
177
18
2
2
2
Products / Services
94
34
26
26
23
MITRE Techniques
114
83
32
32
25
CVEs
3
2
2
1
1
IDS Classtypes
11
4
3
3
1
IDS Protocols
12
10
This rule detects potential command and control (C2) activity where commands are being read from a removable media share over SMB. It specifically looks for SMB traffic containing the string "USBSTOR" (case-insensitive) and ".txt" (case-insensitive), indicating access to text files on a USB storage device. A threshold of 5 occurrences within 30 seconds from the same source IP is applied to reduce false positives.
This rule detects attempts to access browser profile files, specifically looking for 'AppData' and 'Bookmarks' content, on a network share via SMB. This could indicate an adversary attempting to discover sensitive user data.
This rule detects a bulk file copy pattern to a removable share over SMB (port 445). It triggers an alert if there are more than 200 SMB 'to_server' flows from a single source within a 60-second window, indicating a high volume of data transfer. This behavior is often associated with data exfiltration or large-scale data movement to external storage.
This rule detects a high volume of network share connections (SMB/CIFS) from a single device to multiple remote IPs within a short timeframe. This behavior can be indicative of ransomware attempting to encrypt files across network shares, or other forms of rapid lateral movement and data access. The rule specifically looks for connections on ports 445 or 139 initiated by common user or system processes like explorer.exe, cmd.exe, or powershell.exe.
Detects access to sensitive files, credential data, or remote procedure call (RPC) endpoints related to credential dumping over a network share.
This could indicate lateral movement or remote credential harvesting techniques.
This could indicate lateral movement or remote credential harvesting techniques.
This rule detects an unusually high volume of network share access attempts from a single IP address and account within a short time frame (5 minutes). This could indicate an adversary attempting to discover or access network shares, potentially for data exfiltration or lateral movement.
Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.
Detects potential exploitation of CVE-2021-1675 / CVE-2021-34527 (PrintNightmare) via anomalous SMB access to the IPC$ share targeting the "spoolss" named pipe (AccessMask: 0x3).
This pattern is associated with RPC-based abuse of the Windows Print Spooler service, which may allow remote code execution or privilege escalation with SYSTEM privileges.
This pattern is associated with RPC-based abuse of the Windows Print Spooler service, which may allow remote code execution or privilege escalation with SYSTEM privileges.
Detects access to hidden or decoy network shares that are not used by legitimate processes. This activity is indicative of network reconnaissance and lateral movement attempts. Walkthrough of Canary Shares can be found here: https://github.com/fluffybunnies-h4x/CyberDeception/blob/main/README.md#canary-shares
This use case detects when shares are mapped via "net.exe" within command line. More specifically, hidden administrative shares that can be mapped and used to remote file copy malicious files and/or executables.
This rule detects the remote creation of scheduled tasks by monitoring access to the 'ATSVC' named pipe within the IPC$ share. Specifically, it looks for Event ID 5145, indicating a detailed file share access, where the ShareName is '\\*\IPC$', the RelativeTargetName is 'atsvc', and the AccessList contains 'WriteData'. This activity is characteristic of tools like 'at.exe' or direct API calls used to schedule tasks remotely.
Detects unusual processes accessing 'desktop.ini' remotely over a network share with write permissions. This activity can be leveraged to alter how Windows Explorer displays a folder's content (e.g., renaming files) without actually changing the files on disk, which can be used for persistence or privilege escalation.
Detects the creation or modification of scheduled tasks via Group Policy Objects (GPO), which can be used by adversaries for persistence, execution, and lateral movement, often seen in ransomware deployment scenarios. The rule specifically looks for Event ID 5136 (Directory Service Changes) indicating modifications to GPO attributes related to machine or user extension names, and Event ID 5145 (Detailed File Share) indicating write access to ScheduledTasks.xml within the SYSVOL share.
Detects Server Message Block (SMB) server connections to administrative shares (IPC$, ADMIN$, C$) that are established without signing or encryption enabled. This activity could indicate potential lateral movement by an adversary exploiting insecure SMB configurations.
The following analytic detects a high frequency of file copying or moving within network shares, which may indicate potential data sabotage or exfiltration attempts. It leverages Windows Security Event Logs (EventCode 5145) to monitor access to specific file types and network shares. This activity is significant as it can reveal insider threats attempting to transfer classified or internal files, potentially leading to data breaches or evidence tampering. If confirmed malicious, this behavior could result in unauthorized data access, data loss, or compromised sensitive information.
Detects access to known sensitive file extensions on network shares. This can indicate an adversary attempting to collect sensitive data such as backups, memory dumps, Kerberos tickets, or various email/messaging data files.
This rule detects attempts by non-system accounts to create or write to files on administrative shares (e.g., C$) via Server Message Block (SMB). This activity is often associated with lateral movement or persistence techniques where attackers drop tools or establish footholds on remote systems.
Detects remote task creation via at.exe or API interacting with ATSVC namedpipe
Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.
Detects SMB server connections to shares without signing or encryption enabled.
This could indicate potential lateral movement activity using unsecured SMB shares.
This could indicate potential lateral movement activity using unsecured SMB shares.
Detects when a mounted network share is removed using PowerShell cmdlets such as 'Remove-SmbShare' or 'Remove-FileShare'. This activity can be an indicator of an adversary cleaning up traces of their operations.
Page 7 of 10