Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
50 detections
Filters
Last updated
All Time
Detection languages
50
Contributors
44
4
1
1
Categories
36
16
13
12
10
Platforms
48
20
Products / Services
50
5
4
3
1
MITRE Techniques
12
9
8
7
7
IDS Classtypes
37
8
2
1
1
IDS Protocols
2,431
868
408
324
97
50
This rule detects when a file containing the string "XLSTART" (case-insensitive) is written to a network share via SMB. This is indicative of an attempt to establish persistence by placing malicious files in the Microsoft Office startup folder, which will be executed when Office applications launch.
This rule detects when a batch script (.bat) is dropped onto a network share, specifically targeting the NETLOGON share, which is often used for logon scripts. This activity can be indicative of an attacker attempting to establish persistence or execute malicious code on systems that process logon scripts from this share. The rule triggers if three such events are observed from the same source within 60 seconds.
This rule detects attempts to plant a DLL file in an application's 'Program Files' directory over SMB. This is a common technique used in DLL hijacking attacks, where a malicious DLL is placed in a location where a legitimate application will load it instead of the intended system DLL. The rule specifically looks for SMB traffic to port 445, containing '.dll' and '\Program Files\' in a case-insensitive manner, indicating a file transfer to a sensitive application directory.
This rule detects bulk file copies to USB drives via SMB by looking for the string "USBSTOR" (case-insensitive) within SMB traffic on port 445. A threshold of 100 occurrences within 60 seconds from the same source IP triggers the alert, indicating a potential exfiltration attempt.
This rule detects a high volume of file read operations from a network share that contains the string "USBSTOR" in its content, indicating potential access to removable media. It triggers an alert if more than 50 such events occur within a 30-second window from the same source IP address. This could signify an attempt to exfiltrate data from a removable device shared over the network.
This rule detects when a file with the ".pst" extension (Outlook Personal Storage Table file) is copied locally via the Server Message Block (SMB) protocol. This could indicate data exfiltration or unauthorized access to sensitive email archives.
This rule detects attempts to access browser history files, specifically Google Chrome's history, over Server Message Block (SMB) protocol. The detection is triggered when SMB traffic contains the string "History" and "AppData\Local\Google\Chrome" (case-insensitive), indicating a potential reconnaissance activity where an attacker might be trying to exfiltrate or analyze browser history.
This rule detects attempts to move executable files (.exe) over SMB (Server Message Block) by looking for the 'MoveFile' string and the '.exe' extension in network traffic on port 445. This activity could indicate malware being relocated on a network share.
This rule detects when a KeePass database file (.kdbx) is copied to a server via SMB. This could indicate an attempt to exfiltrate sensitive credential data.
This rule detects when a Kerberos credential cache (ccache) file is copied over SMB. Attackers may attempt to steal Kerberos ccache files to obtain Kerberos tickets, which can then be used for various credential access attacks like 'Pass the Ticket'. The rule specifically looks for the string '.ccache' within SMB traffic on port 445, indicating the transfer of such a file.
This rule detects attempts to modify file timestamps over SMB. Specifically, it looks for the 'SetFileTime' operation within SMB traffic on port 445. This activity can be indicative of an adversary attempting to hide their presence or activities by making malicious files appear to have legitimate creation or modification times, a technique known as timestomping.
This rule detects the deployment of a network logon script named 'logon.bat' within the 'SYSVOL' share over SMB (port 445). This activity is often associated with persistence techniques where an attacker modifies or creates logon scripts to execute malicious code when users log in to the domain.
This rule detects attempts to overwrite critical system binaries (specifically executables in 'system32') via Server Message Block (SMB) protocol. It looks for SMB traffic to port 445, containing 'system32' and '.exe' (case-insensitive), with a payload size greater than 100,000 bytes, indicating a potential file transfer or modification of a large executable.
This rule detects an attempt to exploit an unquoted service path vulnerability via an SMB file drop. Specifically, it looks for SMB traffic to port 445 on the home network containing the strings "Program Files" and ".exe" (case-insensitive). This pattern suggests an attacker might be dropping an executable file into a directory within "Program Files" that is part of an unquoted service path, which could lead to arbitrary code execution upon service restart.
This rule detects attempts to exploit DLL Search Order Hijacking vulnerabilities by monitoring SMB network traffic for requests containing '.dll' and '\AppData\' in the content. This pattern suggests an attacker might be attempting to drop a malicious DLL into a user's AppData directory on a network share, which could then be loaded by a legitimate application due to search order vulnerabilities, leading to persistence or execution of malicious code.
This rule detects when an executable file (.exe) is dropped into a Windows 'Start Menu\Programs\Startup' folder via Server Message Block (SMB). This is a common technique used by attackers to establish persistence on a compromised system, ensuring that their malicious code runs every time the user logs in or the system starts.
This rule detects potential data staging activity on a remote SMB share. It specifically looks for traffic to port 445 (SMB) containing 'ADMIN$' (case-insensitive) with a data size greater than 65000 bytes. A threshold of 20 such events within 60 seconds from the same source IP will trigger an alert, indicating a high volume of data being transferred to an administrative share, which could precede exfiltration.
This rule detects the planting of script files, specifically PowerShell scripts (.ps1), on shared network drives. It looks for SMB traffic directed to a server on port 445 (SMB) that contains both the string ".ps1" (case-insensitive) and the string "\\share\\" (case-insensitive). This activity is indicative of an attacker staging scripts on a network share for potential lateral movement within a network.
This rule detects attempts to copy SSL private key files over SMB. It specifically looks for network traffic on port 445 (SMB) containing the strings ".key" and "private" (case-insensitive) in the data being sent to the server. This activity could indicate an attacker attempting to exfiltrate sensitive cryptographic material.
This rule detects attempts to copy the Chrome Login Data SQLite file over SMB. The rule specifically looks for SMB traffic (port 445) containing the strings "Login Data" and "AppData\Local\Google\Chrome" (case-insensitive). This activity is indicative of an attacker trying to exfiltrate sensitive browser data, specifically stored credentials.
This rule detects when an executable file (.exe) is copied to a share associated with a removable drive (indicated by 'USBSTOR') over the SMB protocol. This could indicate an attempt to transfer malicious executables to or from a removable device.
Page 2 of 3