Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
881 detections
Filters
Last updated
All Time
Detection languages
442
92
80
78
55
Contributors
228
168
138
43
37
Categories
20,440
11,814
5,871
5,145
4,864
881
Platforms
595
135
115
71
51
Products / Services
204
150
139
78
67
MITRE Techniques
314
263
221
214
207
CVEs
15
12
4
4
3
IDS Classtypes
20
13
10
8
3
IDS Protocols
24
14
12
1
Detects connections from routable IPs to an RDP listener. Which is indicative of a publicly-accessible RDP service.
The following analytic identifies the execution of `PsExec.exe` with the `accepteula` flag in the command line. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant because PsExec is commonly used by threat actors to execute code on remote systems, and the `accepteula` flag indicates first-time usage, which could signify initial compromise. If confirmed malicious, this activity could allow attackers to gain remote code execution capabilities, potentially leading to further system compromise and lateral movement within the network.
This analytic detects and analyzes PowerShell Web Access (PSWA) usage in Windows environments. It tracks both connection attempts (EventID 4648) and successful logons (EventID 4624) associated with PSWA, providing a comprehensive view of access patterns. The analytic identifies PSWA's operational status, host servers, processes, and connection metrics. It highlights unique target accounts, domains accessed, and verifies logon types. This information is crucial for detecting potential misuse, such as lateral movement, brute force attempts, or unusual access patterns. By offering insights into PSWA activity, it enables security teams to quickly assess and investigate potential security incidents involving this powerful administrative tool.
The analytic detects a user authenticating with special privileges on 30 or more remote endpoints within a 5-minute window. It leverages Event ID 4672 from Windows Security logs to identify this behavior. This activity is significant as it may indicate lateral movement or remote code execution by an adversary. If confirmed malicious, the attacker could gain extensive control over the network, potentially leading to privilege escalation, data exfiltration, or further compromise of the environment. Security teams should adjust detection thresholds based on their specific environment.
The following analytic detects attempts to exploit CVE-2022-26134, an unauthenticated remote code execution vulnerability in Confluence. It leverages the Web datamodel to analyze network and CIM-compliant web logs, identifying suspicious URL patterns and parameters indicative of exploitation attempts. This activity is significant as it allows attackers to execute arbitrary code on the Confluence server without authentication, potentially leading to full system compromise. If confirmed malicious, this could result in unauthorized access, data exfiltration, and further lateral movement within the network. Immediate investigation and remediation are crucial to prevent extensive damage.
The following analytic detects the use of default or publicly known named pipes associated with the RMX remote admin tool. It leverages Sysmon EventCodes 17 and 18 to identify named pipe creation and connection events. This activity is significant as the RMX tool has been abused by adversaries and malware like Azorult to collect data from targeted hosts. If confirmed malicious, this could indicate unauthorized remote administration capabilities, leading to data exfiltration or further compromise of the affected system. Immediate investigation is required to determine the legitimacy of this tool's presence.
The following analytic identifies the execution of RemCom.exe, an open-source alternative to PsExec, used for lateral movement and remote command execution. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, original file names, and command-line arguments. This activity is significant as it indicates potential lateral movement within the network. If confirmed malicious, this could allow an attacker to execute commands remotely, potentially leading to further compromise and control over additional systems within the network.
This analytic detects the use of `mmc.exe` to launch Computer Management (`compmgmt.msc`) and connect to a remote machine. This technique allows administrators to access system management tools, including Event Viewer, Services, Shared Folders, and Local Users & Groups, without initiating a full remote desktop session. While commonly used for legitimate administrative purposes, adversaries may leverage this method for remote reconnaissance, privilege escalation, or persistence. Monitoring the execution of `mmc.exe` with the `/computer:{hostname/ip}` argument can help detect unauthorized system administration attempts or lateral movement within a network.
This detection rule identifies the execution of uncommon or suspicious Remote Monitoring and Management (RMM) tools. While RMM tools are legitimate for IT administration, they are frequently abused by attackers, initial access brokers (IABs), and ransomware operators to establish persistent remote access, execute malicious commands, or deploy additional payloads. The rule specifically looks for process launches of various RMM software that might not be commonly observed in an environment, indicating potential unauthorized access or lateral movement. The list of RMM tools is informed by the LOL-RMM (Living Off the Land RMM) project.
Detects multiple failed requests to access different applications within a short timeframe from the same network session. This could indicate an adversary attempting to bypass authentication mechanisms, potentially using stolen session cookies or brute-forcing access to various applications after an initial compromise. The rule also incorporates risk scoring based on behavioral anomalies (e.g., new geo-location, new device, new IP) and access attempts from high-risk countries.
Detects when files are transferred using the ScreenConnect Remote Monitoring and Management (RMM) tool. This activity can indicate an adversary using legitimate tools for data exfiltration or staging.
Detects the execution of known tunneling and exfiltration tools such as httptunnel, plink, socat, and stunnel. These tools can be abused by adversaries to establish covert communication channels, bypass network restrictions, and exfiltrate data from compromised systems.
This rule detects remote access to the Local Security Authority Subsystem Service (LSASS) process via Windows Remote Management (WinRM). This activity is highly indicative of credential dumping attempts, often performed by tools like Mimikatz, to extract sensitive authentication material from memory. The rule specifically looks for process access events where the target process is 'lsass.exe' and the source process initiating the access is 'wsmprovhost.exe', which is associated with WinRM. It also filters out common benign access patterns (0x80000000 GrantedAccess) to reduce false positives.
Detects cases where ngrok, a legitimate reverse proxy tool, is used to forward traffic to the local Remote Desktop Protocol (RDP) port. This activity can indicate malicious behavior, as adversaries often use tools like ngrok for command and control, bypassing firewalls, or establishing persistent remote access to compromised systems.
This rule identifies user sign-ins originating from anonymous IP addresses, which may indicate the use of VPNs, Tor, or other anonymization services. Such activity can be a sign of an adversary attempting to mask their true location or identity during an access attempt.
This rule detects the initiation of a remote PowerShell session by looking for specific strings in PowerShell Classic logs. Specifically, it identifies events where 'HostName=ServerRemoteHost' and 'wsmprovhost.exe' are present in the log data, indicating that a remote host is interacting via Windows Remote Management (WinRM) to execute PowerShell commands.
This rule detects the execution of the PowerShell cmdlet 'Invoke-Command' with the '-ComputerName' parameter. This combination indicates an attempt to execute commands on a remote host using Windows Remote Management (WinRM). Adversaries commonly use this technique for lateral movement within a network after gaining valid credentials.
This rule detects the creation of a new PowerShell remote session using the 'New-PSSession' cmdlet, specifically when targeting a remote computer via the '-ComputerName' parameter. This activity can be indicative of an adversary establishing remote access or moving laterally within a network.
Detects the initiation of remote PowerShell sessions by identifying specific keywords in the `ContextInfo` field of PowerShell module logs. It looks for the presence of ' = ServerRemoteHost ' and 'wsmprovhost.exe', which are indicative of a remote PowerShell connection. A filter is applied to exclude legitimate PowerShell archive module activity.
Detects suspicious session with two users present
Page 42 of 42