Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
145 detections
Filters
Last updated
All Time
Detection languages
53
41
19
16
11
Contributors
30
19
17
16
10
Categories
117
68
24
15
14
Platforms
143
3
2
1
1
Products / Services
54
41
35
19
10
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
2
2
2
2
2
Identifies anomalous enumeration of local network sessions via cmd.exe using the 'net session' command, a technique observed during EtherRAT's post-exploitation phase for lateral movement reconnaissance.
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
Detects the use of 'net.exe' to create or modify user accounts, specifically looking for commands that include 'user', 'admin', and '/add'. This could indicate an adversary establishing persistence or escalating privileges by creating new administrative accounts.
Detects the creation of a new local user account using the Windows net.exe or net1.exe command-line utilities. This behavior is commonly used by adversaries for persistence or privilege escalation, but excludes common installer processes.
Detects creation or restoration of ADMIN$, C$, or custom hidden shares used for remote ransomware deployment. This rule specifically looks for `net.exe`, `powershell.exe`, or `cmd.exe` executing commands that create or modify SMB shares, targeting administrative shares like ADMIN$, C$, or any share ending with a dollar sign ($).
Detects VBScript (wscript.exe or cscript.exe) attempting to create Windows services using 'sc.exe create' or adding new users using 'net user /add'. This behavior is often associated with persistence mechanisms or privilege escalation by malicious scripts.
This rule detects post-VPN discovery or lateral movement activities by monitoring network connections initiated by specific command-line tools. It targets the use of utilities like PowerShell, cmd, net, nltest, adfind, ldapsearch, wmic, or winrs to interact with many internal systems, which could indicate an attacker performing reconnaissance or moving laterally within the network after gaining initial access, potentially via a compromised VPN.
Affair-Build Script Restarting VDS
Cortex XDR
This rule detects the execution of `cmd.exe`, `powershell.exe`, or `pwsh.exe` that includes the command-line arguments related to an 'affair-build.bat' script or directly stopping/starting the Virtual Disk Service (VDS) using `net` or `sc` commands. It aims to identify cleanup or persistence script sequences that manipulate the VDS.
Detects PHP or web server processes launching common system, account, network, and domain reconnaissance utilities. This activity is often indicative of post-compromise internal reconnaissance, as web-facing application processes should not normally start these utilities. The rule specifically looks for processes like php.exe, w3wp.exe, httpd.exe, apache2, and nginx spawning reconnaissance tools such as whoami, hostname, systeminfo, ipconfig, ifconfig, net, nltest, dsquery, quser, and query.
Detects modification of local or domain group memberships for privilege persistence
Udm Affair Build Vds
YARA-L
This rule detects the execution of `cmd.exe`, `powershell.exe`, or `pwsh.exe` when their command line arguments contain either "affair-build.bat" or commands to stop or start the Virtual Disk service (VDS) using `net` or `sc.exe`. This activity is indicative of a cleanup or persistence script sequence that interacts with the Virtual Disk service.
Detects removal of network share connections to hide unauthorized access
This rule detects post-VPN discovery or lateral movement activities by monitoring network connections initiated by specific command-line tools. It targets the use of utilities like PowerShell, cmd, net, nltest, adfind, ldapsearch, wmic, or winrs to interact with many internal systems, which could indicate an attacker performing reconnaissance or moving laterally within the network after gaining initial access, potentially via a compromised VPN.
Udm Affair Build Vds
YARA-L
This rule detects the execution of `cmd.exe`, `powershell.exe`, or `pwsh.exe` when their command line arguments contain either "affair-build.bat" or commands to stop or start the Virtual Disk service (VDS) using `net` or `sc.exe`. This activity is indicative of a cleanup or persistence script sequence that interacts with the Virtual Disk service.
Detects bulk deletion or disabling of accounts to lock out defenders
Detects creation of accounts with names mimicking legitimate service accounts
This rule detects the creation of a new local user account followed by its addition to the local administrators group within a 10-minute timeframe. It monitors process command lines for 'net.exe' or 'powershell.exe' creating users and then adding them to the 'administrators' group, excluding domain operations.
Detects use of net accounts command for password policy discovery
Detects use of net accounts command for password policy discovery
Detects creation of new local user accounts for persistent access
Detects enumeration of local group membership via net localgroup command
Page 2 of 7