Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
50 detections
Filters
Last updated
All Time
Detection languages
50
Contributors
44
4
1
1
Categories
36
16
13
12
10
Platforms
48
20
Products / Services
50
5
4
3
1
MITRE Techniques
12
9
8
7
7
IDS Classtypes
37
8
2
1
1
IDS Protocols
2,431
868
408
324
97
50
Detects multiple attempts to connect to administrative shares (ADMIN$, C$, IPC$) from a single source within a 60-second window. This pattern is indicative of automated lateral movement or enumeration attempts using the SMB protocol.
Detects sequential suspicious SMB activity characteristic of PsExec lateral movement: connection to ADMIN$ or C$ administrative shares, followed by the upload of an executable or batch file to the share, and subsequently the usage of SVCCTL (CreateServiceW/StartServiceW) to execute the uploaded binary.
Detects SMB traffic targeting the IPC$ share within the internal network, which is a common behavior of PIVOTPIPE lateral movement techniques using SMB named pipes for peer-to-peer (P2P) beacon communication.
Detects anomalous SMB traffic indicating potential ransomware activity. The rule monitors for file operations associated with known ransomware naming conventions (e.g., README.txt, DECRYPT_INSTRUCTIONS) or common ransomware-related extensions. It uses a threshold to identify high-frequency occurrences within a short timeframe, suggesting bulk file renaming or ransom note creation typical of encryption phases.
Detects anomalous SMB traffic indicating potential ransomware activity. The rule monitors for file operations associated with known ransomware naming conventions (e.g., README.txt, DECRYPT_INSTRUCTIONS) or common ransomware-related extensions. It uses a threshold to identify high-frequency occurrences within a short timeframe, suggesting bulk file renaming or ransom note creation typical of encryption phases.
This rule detects when a file with the '.docm' extension is written to a network share via SMB. The presence of '.docm' suggests a macro-enabled Office document, which is often used in malicious campaigns. The rule specifically looks for the content '.docm' and a backslash character ('\') within the SMB traffic, indicating a file path or content related to a document.
This rule detects attempts to modify the end-of-file marker on a network share, specifically looking for the 'SetEndOfFile' operation over SMB. This activity can be indicative of an attacker manipulating file sizes or content on shared resources, potentially as part of data staging or to evade detection. The rule is configured with a threshold to alert on 20 such events from the same source within 30 seconds, aiming to reduce noise from legitimate, infrequent operations.
This rule detects potential air-gap bridging activity via removable media. Specifically, it looks for SMB traffic on port 445 containing the string "USBSTOR" (case-insensitive) and the file extension ".bin" (case-insensitive). This combination suggests a file transfer related to USB storage, possibly a firmware update or a malicious payload, being moved across a network segment, potentially bypassing an air-gapped system.
This rule detects attempts to perform remote DLL injection via UNC path writes over SMB. It specifically looks for SMB traffic to port 445 on the home network, containing ".dll", "\\", and "System32" in a case-insensitive manner. This combination suggests an attempt to write a DLL file to a System32 directory on a remote machine using a UNC path, which is a common technique for DLL injection.
This rule detects when an executable file (.exe) is dropped into a shared network folder. It specifically looks for SMB traffic containing both ".exe" and "\\share\\" in the content, indicating a potential attempt to distribute malicious executables or move them laterally within a network.
This rule detects attempts to read the 'cpassword' field from Group Policy Preferences XML files over SMB. The 'cpassword' field was historically used to store encrypted passwords, which could be easily decrypted, leading to credential exposure. Detection of this string in SMB traffic indicates an attempt to access or exfiltrate these sensitive credentials.
This rule detects large data transfers (over 65000 bytes) to a Server Message Block (SMB) share that contains the string "USBSTOR" in its content. This combination suggests data exfiltration to removable media, as "USBSTOR" is often associated with USB storage devices. The rule uses a threshold of 20 such transfers within 60 seconds from the same source IP to trigger an alert, indicating a sustained large data transfer activity.
This rule detects attempts to copy Firefox profile data, specifically the 'places.sqlite' file, over SMB (Server Message Block) to a server. This activity is indicative of browser reconnaissance, where an attacker might be exfiltrating browsing history and bookmarks stored in the Firefox profile for further analysis or to gain intelligence about the victim.
This rule detects attempts to copy the Active Directory Certificate Services (ADCS) certificate database for offline forgery. Specifically, it looks for SMB traffic to a server on port 445 (SMB) containing the string "certnew.cer" (case-insensitive) in the content, indicating a file transfer of a newly issued certificate. This activity is often associated with credential access techniques, where an attacker might exfiltrate certificate data to forge credentials.
This rule detects attempts to modify web server files, specifically 'index.html' within a 'wwwroot' directory, over the Server Message Block (SMB) protocol. The detection is based on the presence of these strings in network traffic directed to port 445 (SMB) on the internal network. This activity could indicate an attacker attempting to deface a web server or inject malicious code.
This rule detects when an Outlook OST (Offline Storage Table) file is accessed over SMB (Server Message Block) protocol. The detection is triggered by the presence of the string ".ost" (case-insensitive) in the network traffic on port 445 (SMB). This activity could indicate an attempt to collect local email data.
This rule detects attempts to enumerate Group Policy Objects (GPOs) by accessing the SYSVOL share over SMB. It specifically looks for SMB traffic to port 445 containing both 'SYSVOL' and 'GroupPolicy' keywords, indicating an attempt to browse or access GPO-related files. A threshold of 5 such events within 30 seconds from the same source IP triggers the alert, suggesting a potential network scan or reconnaissance activity.
This rule detects when a Windows logon script (specifically a .bat file) is written to the NETLOGON share over SMB. This activity is often associated with persistence techniques where an attacker modifies or creates a logon script to execute malicious code when a user logs on to a domain-joined machine.
This rule detects attempts to harvest Group Policy Preferences (GPP) credentials from the SYSVOL share over SMB. It specifically looks for network traffic on port 445 (SMB) containing the strings "SYSVOL" and "Groups.xml" in a case-insensitive manner, indicating a potential attempt to access the file where GPP credentials might be stored.
This rule detects the writing of an 'autorun.inf' file to a Server Message Block (SMB) share, specifically targeting removable media shares. The presence of 'autorun.inf' on removable media is often associated with malware attempting to auto-execute when the media is inserted into a Windows system.
This rule detects attempts to drop a payload into the Microsoft Word startup folder via SMB. The detection is based on the presence of the string "Word\STARTUP" (case-insensitive) in SMB traffic flowing to the server on port 445. This activity is indicative of persistence mechanisms used by attackers to ensure malicious code executes when Word starts.
Page 1 of 3