Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
2
1
Categories
3
1
1
1
Platforms
3
Products / Services
3
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
This rule detects the execution of common remote execution and lateral movement tools by monitoring process command lines for specific keywords. The tools include pth-winexe, crackmapexec, impacket, smbexec, and wmiexec, which are frequently used by adversaries for remote code execution and network reconnaissance.
This rule detects the execution of common remote execution and lateral movement tools by monitoring process command lines for specific keywords. The tools include pth-winexe, crackmapexec, impacket, smbexec, and wmiexec, which are frequently used by adversaries for remote code execution and privilege escalation.
Detects Pass-the-Hash attacks using NTLM authentication over SMB
