Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
151 detections
Filters
Last updated
All Time
Detection languages
71
42
12
10
8
Contributors
43
35
20
13
7
Categories
85
60
25
14
12
Platforms
151
4
Products / Services
36
36
27
21
12
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
1
IDS Classtypes
8
2
IDS Protocols
12
Detects the execution of the PsExec service (PSEXESVC) or command-line usage indicating remote service execution, including the standard PsExec '-accepteula' flag combined with network path indicators. Additionally detects the creation of the PSEXESVC service registry key, which is indicative of PsExec-based lateral movement or remote administration.
This rule detects potential lateral movement activities post-compromise by monitoring process creation events (EventID 4688, 4689) for common administrative tools like PsExec, WMIC, and commands related to scheduled tasks. It specifically looks for these tools being used to execute commands on multiple target computers from a single initiating account within a short timeframe (2 hours), indicating an adversary attempting to move across the network.
This rule detects potential lateral movement activities post-compromise by monitoring process creation events (EventID 4688, 4689) for common administrative tools like PsExec, WMIC, and commands related to scheduled tasks. It specifically looks for these tools being used to execute commands on multiple target computers from a single initiating account within a short timeframe (2 hours), indicating an adversary attempting to move across the network.
This rule detects events generated by Microsoft Defender for Endpoint's Attack Surface Reduction (ASR) rules in either Audit or Block mode.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
This rule detects potential lateral movement activities by monitoring for the execution of 'psexec', 'wmiexec', or 'schtasks' commands within a short timeframe on the same computer. A count of 2 or more such command executions within an hour is flagged as suspicious, indicating potential adversary activity.
This rule detects potential lateral movement activities using `wmic.exe`, `psexec.exe`, or `wmiprvse.exe`. It specifically looks for these executables being run with command-line arguments indicative of remote execution or specific PsExec usage (e.g., containing backslashes for paths, `/accepteula`, or `-s`). The rule then aggregates these events and flags instances where the same process command line is observed multiple times on a device, and there are distinct remote targets involved, suggesting coordinated lateral movement.
This rule detects potential lateral movement activities using `wmic.exe`, `psexec.exe`, or `wmiprvse.exe`. It specifically looks for these executables being run with command-line arguments indicative of remote execution or specific PsExec usage (e.g., containing backslashes for paths, `/accepteula`, or `-s`). The rule then aggregates these events and flags instances where the same process command line is observed multiple times on a device, and there are distinct remote targets involved, suggesting coordinated lateral movement.
This rule detects the execution of PsExec or similar tools (psexec.exe, psexec64.exe, paexec.exe) which are commonly used for lateral movement within a network. It also identifies the use of PsExec service (psexesvc.exe) or command-line arguments indicative of PsExec activity, such as accessing administrative shares (ADMIN$, C$, IPC$) or the '-accepteula' flag.
Detects the use of the klist utility via cmd.exe to enumerate active authentication credentials (Kerberos tickets) on a host. This discovery step is consistently used by threat actors, such as LeakNet, to map out accessible credentials before attempting lateral movement with tools like PsExec.
Detects execution of tools and artefacts reported in Unit 42 Muddled Libra operational playbook, including Chisel tunnelling, PsExec, ADExplorer, S3 Browser, and goon.zip staging.
This rule detects the execution of PsExec or similar tools (psexec.exe, psexec64.exe, paexec.exe) which are commonly used for lateral movement within a network. It also identifies the use of PsExec service (psexesvc.exe) or command-line arguments indicative of PsExec activity, such as accessing administrative shares (ADMIN$, C$, IPC$) or the '-accepteula' flag.
Detects suspicious usage of remote execution tools like PsExec, WMIC, and PowerShell, which are commonly used for lateral movement by adversaries. The rule identifies instances where these tools are executed multiple times within a short period (more than 2 times in 5 minutes) from non-system accounts and outside of standard system directories, indicating potential malicious activity.
Detects suspicious Windows process execution that may indicate post-exploitation activity, lateral movement, or privilege escalation. This is a generic detection rule for uncommon or high-risk commands and tools.
This rule detects the creation of the PsExec service (PSEXESVC, psexesvc, svcsvc, spoolsrv) or the execution of psexec.exe. PsExec is a legitimate Microsoft tool that allows administrators to execute processes on remote systems, but it is frequently abused by attackers for lateral movement and remote execution.
Detects the execution of legitimate or dual-use tools commonly used by the CL-CRI-1040/Storm-2603 actor for post-exploitation activities like credential dumping, reconnaissance, and lateral movement. The rule attempts to reduce false positives by looking for execution from unusual paths or by suspicious parent processes.
Detects a pattern of behavior associated with VanHelsing ransomware's lateral movement, where an executable is written to a device over SMB and then executed shortly after. This is indicative of remote code execution techniques like those using PsExec.
Detects the use of NirCmd tool for command execution, which could be the result of legitimate administrative activity
Detects the use of NirCmd tool for command execution as SYSTEM user
Detects the use of the RunXCmd tool to execute commands with System or TrustedInstaller accounts
The analytic detects the creation of a Windows service named "Sliver" with the description "Sliver Implant," indicative of SliverC2 lateral movement using the PsExec module. It leverages Windows EventCode 7045 from the System Event log to identify this activity. This behavior is significant as it may indicate an adversary's attempt to establish persistence or execute commands remotely. If confirmed malicious, this activity could allow attackers to maintain control over the compromised system, execute arbitrary code, and further infiltrate the network.
Detects the execution of an executable with a 7-character lowercase alphanumeric name from the ADMIN$ share. This pattern is often associated with lateral movement techniques where tools like PsExec are used with randomly named service executables.
Page 3 of 8