Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
145 detections
Filters
Last updated
All Time
Detection languages
53
41
19
16
11
Contributors
30
19
17
16
10
Categories
117
68
24
15
14
Platforms
143
3
2
1
1
Products / Services
54
41
35
19
10
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
2
2
2
2
2
Detects the execution of 'net.exe' or 'net1.exe' with command-line arguments commonly used for discovery activities related to accounts, groups, shares, and services. This rule aims to identify potential reconnaissance or privilege escalation attempts.
Detects reconnaissance activity involving attempts to enumerate domain administrator accounts and domain groups. Specifically, it looks for Event ID 4661 (An operation was performed on an object) with an AccessMask of '0x2d' (which indicates a read access attempt) on SAM_USER or SAM_GROUP objects whose ObjectName corresponds to well-known SIDs for the built-in Administrator account (-500) or Domain Admins group (-512) within a domain (S-1-5-21- prefix). This activity is often associated with adversaries using commands like 'net user administrator /domain' or 'net group domain admins /domain' to discover privileged accounts.
This rule detects the execution of 'net.exe' or 'net1.exe' with the command-line argument '/TRANSPORT:QUIC'. This combination indicates an attempt to mount Windows SMB shares over QUIC, which might be an unusual or unexpected activity in many enterprise environments. Adversaries could leverage this for lateral movement or data access.
Detects suspicious manipulations of default accounts such as 'administrator' and 'guest' using `net.exe` or `net1.exe`. This includes actions like enabling/disabling accounts or changing passwords, which are often performed by adversaries for persistence or impact.
Detects when the 'net.exe' or 'net1.exe' utility is used with the 'share' and '/delete' commands to remove a mounted network share. This activity can be performed by adversaries to clean up traces of their operations.
This rule detects the use of 'net.exe' or 'net1.exe' with the 'use' command to mount an administrative share (e.g., C$, ADMIN$) on a Windows system. This activity is often associated with lateral movement by adversaries.
This rule detects attempts to discover network connections on a system using the built-in Windows `net.exe` or `net1.exe` utility with the `use` or `sessions` commands. Adversaries often use these commands to map out network resources and active user sessions on compromised systems.
This rule detects the execution of 'net.exe' or 'net1.exe' with a password provided directly in the command line. This is a security risk as it exposes credentials and can be used for lateral movement, persistence, or privilege escalation. The rule specifically looks for the 'use' keyword, a colon followed by an asterisk and a backslash (indicating a password field), and '/USER:* *' to identify password usage in the command line arguments.
Detects the creation of new Windows services using either the 'sc.exe' command-line utility or the PowerShell 'New-Service' cmdlet. The rule specifically looks for suspicious binary paths associated with the newly created service, including common scripting interpreters (powershell, wscript, cscript, cmd), system binaries (svchost, dllhost, rundll32), and suspicious user-writable directories (Public, Downloads, Desktop, Startup, Temp). This activity is often indicative of persistence or privilege escalation attempts by adversaries.
Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE. This rule identifies attempts to enumerate local or domain groups and accounts, specifically looking for commands that list members of sensitive groups like 'domain admins' or 'enterprise admins', or general account information. It filters out commands that are used to add users or groups to reduce false positives. The rule also includes checks for common administrative group names in multiple languages.
Detects the creation of local user accounts using the `net.exe` or `net1.exe` command-line utility with the `expires:never` option, which indicates that the account password will not expire. This is a common technique used by adversaries to establish persistent access.
Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content from it. This technique has been observed in malicious LNK files, often used for initial access or execution of payloads from remote shares.
Detects the usage of the "net.exe" or "net1.exe" command-line utility to start a Windows service using the "start" flag. This activity can be indicative of an adversary executing a service, potentially for persistence or privilege escalation.
Detects the stopping of a Windows service using the 'net.exe' or 'net1.exe' utility with the 'stop' command-line argument. This rule specifically looks for the execution of these utilities with the intent to terminate a service.
Detects the creation of new local user accounts using the 'net.exe' or 'net1.exe' command-line utility with the 'user add' arguments. This activity can be indicative of an adversary establishing persistence or creating accounts for lateral movement.
Detects attempts to enumerate file shares, printer shares, and sessions using the 'net.exe' or 'net1.exe' utility with the 'view' flag. This activity is often performed by adversaries for remote system discovery.
Detects when an internet-hosted WebDAV share is mounted using the `net.exe` or `net1.exe` utility. This activity can be indicative of an adversary attempting to establish remote access or exfiltrate data by mounting a remote share.
Detects when a network share is mounted using the "net.exe" or "net1.exe" utility with the 'use' command, indicating potential lateral movement or data access activity.
Detects activity as "net user administrator /domain" and "net group domain admins /domain"
Page 7 of 7