Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
197 detections
Filters
Last updated
All Time
Detection languages
71
49
23
23
11
Contributors
49
39
31
20
14
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
177
18
2
2
2
Products / Services
94
34
26
26
23
MITRE Techniques
114
83
32
32
25
CVEs
3
2
2
1
1
IDS Classtypes
11
4
3
3
1
IDS Protocols
12
10
Detects potential BlackLock ransomware activity where a process is launched with command-line arguments for network scanning and subsequently makes an SMB connection.
This rule detects attempts to transfer sensitive files containing credential data via network shares. It specifically looks for Event ID 5145 (A network share object was checked to see whether client can be granted desired access) and checks if the 'RelativeTargetName' of the accessed object contains well-known filenames or paths associated with credential storage, such as Mimikatz output, LSASS memory dumps, Windows minidumps, hibernation files, SQL dumps, or critical system files like NTDS.dit, SAM, SECURITY, and SYSTEM hives.
KQL Query
This rule detects attempts to access the Windows share IPC with the specific target name "cert," which could indicate unauthorized certificate requests. This behavior has been linked to tools such as Certipy.
KQL Query from file: Suspicious WebDav connections
This analytic detects the execution of the Invoke-ShareFinder PowerShell cmdlet from PowerView. This detection leverages PowerShell Script Block Logging to identify instances where this specific command is executed. Monitoring this activity is crucial as it indicates an attempt to enumerate network file shares, which may contain sensitive information such as backups, scripts, and credentials. If confirmed malicious, this activity could enable an attacker to escalate privileges or move laterally within the network, potentially compromising additional systems and sensitive data.
This query looks for users sharing access to files with external users.
This applies to SharePoint and OneDrive users.
Audit event and Cloud application identifier references.
Reference - https://learn.microsoft.com/microsoft-365/compliance/audit-log-sharing?view=o365-worldwide
Reference - https://learn.microsoft.com/azure/sentinel/entities-reference#cloud-application-identifiers
This applies to SharePoint and OneDrive users.
Audit event and Cloud application identifier references.
Reference - https://learn.microsoft.com/microsoft-365/compliance/audit-log-sharing?view=o365-worldwide
Reference - https://learn.microsoft.com/azure/sentinel/entities-reference#cloud-application-identifiers
This query helps hunting for BEC - File sharing tactics - OneDrive or SharePoint
The following analytic detects shared files in Google Drive with suspicious filenames commonly used in spear phishing campaigns. It leverages GSuite Drive logs to identify documents with titles that include keywords like "dhl," "ups," "invoice," and "shipment." This activity is significant because such filenames are often used to lure users into opening malicious documents or clicking harmful links. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further compromise of the user's system.
This query identifies files that are copied to a device over SMB, then executed within a
specified threshold. Default is 5 seconds, but is configurable by tweaking the value for
ToleranceInSeconds.
specified threshold. Default is 5 seconds, but is configurable by tweaking the value for
ToleranceInSeconds.
Detects the execution of copy commands or utilities (robocopy, xcopy, cmd copy, PowerShell Copy-Item/Move-Item) targeting or originating from Windows administrative shares (like C$, ADMIN$) or the SYSVOL folder. This activity can indicate lateral movement or data staging by an adversary.
This rule detects the use of the 'net use' command to connect to Windows administrative shares (C$, ADMIN$, IPC$). Adversaries often use these shares for lateral movement, file transfer, and remote execution within a network. The rule specifically looks for command-line executions containing 'net use' followed by one of the common administrative share names, case-insensitively.
This rule detects the use of the 'net use' command to connect to Windows administrative shares (C$, ADMIN$, IPC$). It specifically looks for these commands being executed by users who are not part of the 'Information Technology' department or who have the title 'Intern', indicating potentially suspicious activity or a deviation from standard administrative practices. The rule leverages user enrichment data to refine its detection.
Net use commands for SMB/Windows admin shares focused on UDM enriched user fields
Detect the use of net use for SMB/Windows admin shares
This analytic detects executable files (.exe or .dll) being written to Windows administrative SMB shares (Admin$, IPC$, C$). This behavior is significant as it is commonly used by tools like PsExec/PaExec for staging binaries before creating and starting services on remote endpoints, a technique often employed for lateral movement and remote code execution. If confirmed malicious, this activity could allow an attacker to execute arbitrary code remotely, potentially compromising additional systems within the network.
This analytic detects a single source computer accessing Windows administrative shares (C$, Admin$, IPC$) on 30 or more remote endpoints within a 5-minute window. It leverages Windows Event IDs 5140 and 5145, which are generated for file share events. This behavior is significant as it may indicate an adversary enumerating network shares to locate sensitive files, a common tactic used by threat actors for reconnaissance and lateral movement. If confirmed malicious, this activity could lead to unauthorized access to critical data, lateral movement, and potential compromise of multiple systems within the network.
The analytic detects network share access requests indicative of the PetitPotam attack (CVE-2021-36942). It leverages Windows Event Code 5145, which logs attempts to access network share objects. This detection is significant as PetitPotam can coerce authentication from domain controllers, potentially leading to unauthorized access. If confirmed malicious, this activity could allow attackers to escalate privileges or move laterally within the network, posing a severe security risk. Ensure Event Code 5145 is enabled via Group Policy to utilize this analytic effectively.
This analytic detects access to Windows administrative SMB shares (Admin$, IPC$, C$) using the 'dir' command. It leverages Windows Security Event Logs with EventCode 5140 to identify this activity. This behavior is significant as it is commonly used by tools like PsExec/PaExec for staging binaries before creating and starting services on remote endpoints, a technique often employed by adversaries for lateral movement and remote code execution. If confirmed malicious, this activity could allow attackers to propagate malware, such as IcedID, across the network, leading to widespread infection and potential data breaches.
The analytic detects the execution of 7z, 7za, or 7zr processes with command lines pointing to SMB network shares. This activity may indicate an attempt to archive and exfiltrate sensitive files to a network share, a technique observed in CONTI LEAK tools. If confirmed malicious, this behavior could lead to data exfiltration, compromising sensitive information and potentially aiding further attacks.
The following analytic detects the creation or deletion of Windows shares using the net.exe command. It leverages Endpoint Detection and Response (EDR) data to identify processes involving net.exe with actions related to share management. This activity is significant because it may indicate an attacker attempting to manipulate network shares for malicious purposes, such as data exfiltration, malware distribution, or establishing persistence. If confirmed malicious, this activity could lead to unauthorized access to sensitive information, service disruption, or malware introduction. Immediate investigation is required to determine the intent and mitigate potential threats.
Page 8 of 10