Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
197 detections
Filters
Last updated
All Time
Detection languages
71
49
23
23
11
Contributors
49
39
31
20
14
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
177
18
2
2
2
Products / Services
94
34
26
26
23
MITRE Techniques
114
83
32
32
25
CVEs
3
2
2
1
1
IDS Classtypes
11
4
3
3
1
IDS Protocols
12
10
Detects instances where an SMB service on an OpenCanary honeypot node has received a file open request. This indicates an adversary is interacting with the honeypot's SMB share, potentially attempting to discover or access files.
This rule identifies when a Google Workspace user shares a file on Google Drive shortly after a suspicious login event has occurred. It correlates a successful login event flagged as suspicious with subsequent Google Drive file sharing activities (changing user access, document visibility, access scope, or ACL editors) by the same user within a one-hour window. This behavior could indicate an attacker gaining access to an account and then exfiltrating data.
Detects the execution of Impacket's psexec.py by monitoring for specific file share access patterns on the IPC$ share. The rule looks for EventID 5145 (a detailed file share access event) where the ShareName is '\\*\IPC$' and the RelativeTargetName contains 'RemCom_stdin', 'RemCom_stdout', or 'RemCom_stderr'. These file names are characteristic of how Impacket's psexec.py communicates with the remote service.
Detects attempts to dump Active Directory credentials using Impacket's secretdump tool. This rule specifically looks for Event ID 5145 (A network share object was checked to see whether client can be granted desired access) on the ADMIN$ share, combined with access to a temporary file within the SYSTEM32 directory. This pattern is indicative of secretdump's remote activity to extract credential hashes.
This rule detects the transfer of sensitive files containing credential data over network shares. It specifically looks for filenames or paths commonly associated with credential dumping, such as 'mimidrv', 'lsass', 'windows\minidump\', 'hiberfil', 'sqldmpr', 'sam', 'ntds.dit', and 'security'. This activity often indicates an attempt to exfiltrate credentials after they have been dumped from a system.
Detects remote printer driver load from a Detailed File Share event in Windows Security logs, which is indicative of successful exploitation attempts against the Print Spooler vulnerabilities CVE-2021-1675 (PrintNightmare) and CVE-2021-34527.
This rule detects attempts to access the hidden administrative network share 'ADMIN$' on Windows systems. The 'ADMIN$' share is a default hidden share that maps to the Windows directory (usually C:\Windows) and is primarily used for remote administration. Adversaries often leverage these administrative shares for lateral movement, file transfer, and remote execution within a compromised network. The rule specifically looks for Event ID 5140, which indicates a network share object was accessed, and filters for the 'Admin$' ShareName. It also filters out access from computer accounts (ending with '$') to reduce false positives from legitimate system activities.
This rule detects attempts to coerce authentication using the PetitPotam technique. It specifically looks for Windows Security Event ID 5145, which indicates a network share access, where the ShareName starts with '\\' and ends with '\IPC$', the RelativeTargetName is 'lsarpc', and the SubjectUserName is 'ANONYMOUS LOGON'. This combination of events is indicative of a PetitPotam attack attempting to force a domain controller to authenticate to a malicious server.
Detects access to files and shares with specific names and extensions associated with BlueSky ransomware, indicating a potential or active encryption attempt. The rule looks for files ending with '.bluesky' or containing 'DECRYPT FILES BLUESKY' in their names, across both local file access events (EventID 4663, 4656) and network share access events (EventID 5145).
This rule detects the execution of PsExec or PAExec by monitoring network share access to the IPC$ share. Specifically, it looks for access to named pipes ending with '-stdin', '-stdout', or '-stderr', which are characteristic of PsExec/PAExec communication. The rule filters out instances where the service name starts with 'PSEXESVC', indicating the standard Sysinternals PsExec service, to reduce false positives for legitimate PsExec usage or when the attacker uses a different PsExec client.
This rule detects the use of PowerShell to mount Server Message Block (SMB) shares over the QUIC transport protocol. This activity, while legitimate, can be unusual in some enterprise environments and may indicate an adversary attempting to establish lateral movement or data transfer channels using a less common protocol.
This rule detects the first-time use of a remote named pipe, excluding commonly known legitimate pipes. This can help identify lateral movement and remote execution attempts using named pipes, as adversaries often leverage these for inter-process communication across networked systems.
Detects access to a file share with a specific naming schema ('\MSHTML_C7\' and an IP address pattern) that has been observed during exploitation of CVE-2023-36884. This rule looks for Windows Security Event ID 5140 (A network share object was accessed) where the ShareName or ShareLocalPath contains the characteristic string and an IP address.
Detects remote service activity by monitoring access to the 'svcctl' named pipe via the IPC$ share. This activity is indicative of an attacker attempting to interact with services on a remote system, often as part of lateral movement or persistence efforts.
This rule detects the execution of PsExec or PAExec when the service name has been renamed from its default 'PSEXESVC'. It specifically looks for SMB file access events (smb_files) in Zeek logs where the path contains '\IPC$' and the name ends with '-stdin', '-stdout', or '-stderr', but filters out events where the name starts with 'PSEXESVC'. This helps to identify potentially malicious use of PsExec-like tools that attempt to evade detection by altering the service name, while reducing noise from legitimate PsExec usage or other PsExec clients.
This rule detects the use of the PowerShell cmdlet 'Get-SmbShare', which adversaries may use to discover shared folders and drives on remote systems. This information can be leveraged for data collection or lateral movement within a network.
This rule detects the execution of the PowerShell cmdlet `Get-SmbShare`. Adversaries often use this cmdlet to discover shared folders and drives on remote systems, which can help them identify valuable information for collection or potential targets for lateral movement. This activity is a common precursor to further reconnaissance and exploitation within a network.
This rule detects the use of the PowerShell cmdlet `New-PSDrive` to map a new drive to a remote Windows administrative share (e.g., C$, ADMIN$). This activity is often associated with lateral movement by adversaries who use valid credentials to interact with remote systems over Server Message Block (SMB). The rule specifically looks for the `New-PSDrive` cmdlet, the `-psprovider filesystem` argument, the `-root` argument, and the presence of a UNC path (`\\`) ending with a dollar sign (`$`), which is characteristic of administrative shares.
Detects access to a protected_storage service over the network. Potential abuse of DPAPI to extract domain backup keys from Domain Controllers
Detects access to ADMIN$ network share
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario.
Page 9 of 10