Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
145 detections
Filters
Last updated
All Time
Detection languages
53
41
19
16
11
Contributors
30
19
17
16
10
Categories
117
68
24
15
14
Platforms
143
3
2
1
1
Products / Services
54
41
35
19
10
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
2
2
2
2
2
Detects the creation of new domain user accounts using the 'net user /add /domain' command. This activity can be indicative of an adversary establishing persistence or escalating privileges within a Windows domain environment.
Detects the addition of new domain accounts using the 'net group /add /domain' command. This activity can be indicative of an adversary establishing persistence or escalating privileges within a domain environment.
Detects the execution of 'net use' commands targeting administrative shares (C$ or ADMIN$) on Windows systems. This behavior is frequently associated with lateral movement, where an adversary attempts to connect to remote file shares using administrative credentials to move files or execute malicious payloads.
Detects the use of common 'net' utility commands used by attackers to enumerate local and domain users and groups, such as domain admins or Exchange-specific security groups. This activity is a common indicator of reconnaissance during the post-exploitation phase.
Detects the use of the Windows 'net use' utility to mount a C$ administrative share using explicit user credentials. This behavior is commonly associated with lateral movement techniques where an adversary attempts to connect to a remote system share to gain access, transfer files, or execute binaries.
This rule detects the creation of a new local user account followed by its addition to the local administrators group within a 10-minute timeframe. It monitors process command lines for 'net.exe' or 'powershell.exe' creating users and then adding them to the 'administrators' group, excluding domain operations.
Detects the creation of a new local user account using the Windows net.exe or net1.exe command-line utilities. This behavior is commonly used by adversaries for persistence or privilege escalation, but excludes common installer processes.
Detects the use of the 'net.exe' or 'net1.exe' utilities with the 'group' and '/domain' arguments, indicating an attempt to query domain-level groups. This technique is commonly used by attackers during the discovery phase to map out domain security groups.
Detects the execution of common command-line utilities (net.exe, dsquery.exe, AdFind.exe) used to query Active Directory for user information. This pattern is characteristic of adversary discovery activities targeting domain user accounts and group memberships. The rule filters out processes launched by Microsoft-signed binaries to reduce noise.
Identifies anomalous enumeration of local network sessions via cmd.exe using the 'net session' command, a technique observed during EtherRAT's post-exploitation phase for lateral movement reconnaissance. The rule specifically looks for the command line arguments '/d /s /c' in conjunction with 'net session'.
Detects the execution of common command-line utilities (net.exe, dsquery.exe, AdFind.exe) used to query Active Directory for user information. This pattern is characteristic of adversary discovery activities targeting domain user accounts and group memberships. The rule filters out processes launched by Microsoft-signed binaries to reduce noise.
This rule detects the creation of new user accounts via the Windows 'net user' command or Windows Security Event 4720 where the account name or command line arguments contain the string 'rage_master_'. This pattern suggests the potential creation of an unauthorized or backdoor account, possibly related to a specific naming convention used by an actor or a naming collision with malicious activity.
Detects the use of the Windows net.exe or net1.exe utilities to add users to privileged groups such as 'Administrators' or 'Domain Admins'. This is a common technique used by attackers to achieve privilege escalation or establish persistence by modifying sensitive account group memberships.
Detects the use of the Windows net.exe or net1.exe utilities to add users to privileged groups such as 'Administrators' or 'Domain Admins'. This is a common technique used by attackers to achieve privilege escalation or establish persistence by modifying sensitive account group memberships.
Detects suspicious payload execution or unexpected child processes spawning directly from the IIS worker process (w3wp.exe), which is a common indicator of web shell activity or exploit payload execution on vulnerable IIS instances.
Detects the use of the Windows net.exe or net1.exe utility to query network shares or session information, which is a common technique used by attackers for internal reconnaissance and network discovery.
Detects the use of the Windows net.exe or net1.exe utility to query network shares or session information, which is a common technique used by attackers for internal reconnaissance and network discovery.
Correlates a successful Fortinet SSL VPN session with nltest, net, Get-AD*, AdFind, ldapsearch, WinRS, or WMIC discovery commands for the same account within forty-five minutes. This behavior can indicate an attacker establishing initial access via VPN and then performing internal reconnaissance.
Detects the use of the 'net.exe' or 'net1.exe' utilities with the 'group' and '/domain' arguments, indicating an attempt to query domain-level groups. This technique is commonly used by attackers during the discovery phase to map out domain security groups.
Detects VBScript (wscript.exe or cscript.exe) attempting to create Windows services using 'sc.exe create' or adding new users using 'net user /add'. This behavior is often associated with persistence mechanisms or privilege escalation by malicious scripts.
Detects a loop attempting 'net use' against multiple IPC$ shares and recording reachable SMB hosts. This activity is indicative of network reconnaissance, specifically looking for accessible shares on remote systems within a subnet.
Page 1 of 7