Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9 detections
Filters
Last updated
All Time
Detection languages
9
Contributors
4
2
2
1
Categories
4
4
4
3
2
Platforms
6
2
1
Products / Services
3
3
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
This rule detects suspicious activity related to high-volume Server Message Block (SMB) share enumeration and the execution of a specific Python script named 'backup_dfs.py'. It combines three detection logics: identifying processes executing 'backup_dfs.py', detecting an unusual number of SMB network connections to common administrative shares (SYSVOL, NETLOGON, DFS), and flagging high-volume SMB-related identity directory events targeting SYSVOL or NETLOGON. This behavior could indicate an adversary performing discovery of network shares, collecting data, or preparing for data exfiltration.
This rule detects suspicious activity related to high-volume Server Message Block (SMB) share enumeration and the execution of a specific Python script named 'backup_dfs.py'. It combines three detection logics: identifying processes executing 'backup_dfs.py', detecting an unusual number of SMB network connections to common administrative shares (SYSVOL, NETLOGON, DFS), and flagging high-volume SMB-related identity directory events targeting SYSVOL or NETLOGON. This behavior could indicate an adversary performing discovery of network shares, collecting data, or preparing for data exfiltration.
This rule detects network connections made over FTP (port 21) where the remote URL contains keywords often associated with legacy or specific network services like 'NetWare', 'NFS', or 'Novell', combined with the presence of multiple spaces or specific 'whitespace' keywords. This combination could indicate unusual or potentially malicious activity, such as attempts to interact with outdated systems or obfuscate URLs.
This rule detects network connections made over FTP (port 21) where the remote URL contains keywords often associated with legacy or specific network services like 'NetWare', 'NFS', or 'Novell', combined with the presence of multiple spaces or specific whitespace indicators. This combination could indicate an attempt to interact with or exploit older network protocols or systems, potentially for reconnaissance or data exfiltration.
This rule detects an unusually high volume of network share access attempts from a single IP address and account within a short time frame (5 minutes). This could indicate an adversary attempting to discover or access network shares, potentially for data exfiltration or lateral movement.
This rule detects an unusually high volume of network share access attempts from a single IP address and account within a short time frame (5 minutes). This could indicate an adversary attempting to discover or access network shares, potentially for data exfiltration or lateral movement.
verifica se um share de rede foi criado nos ultimos x dias
This query can be used to explore any instances where a terminated individual (i.e. one who has an impending termination date but has not left the company) downloads a large number of files from a non-Domain network address.
Intent:
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.