Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9 detections
Filters
Last updated
All Time
Detection languages
6
2
1
Contributors
5
2
1
1
Categories
6
5
3
2
2
Platforms
9
6
Products / Services
6
5
5
1
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
5
IDS Classtypes
5
1
IDS Protocols
6
Detects network traffic patterns characteristic of the EternalBlue (MS17-010) exploit targeting the SMBv1 protocol. Specifically, it monitors for a malformed SESSION_SETUP request containing an unusually large payload, which is indicative of an attempt to trigger a buffer overflow in the SMB service.
Detects network traffic attempting to exploit the SMBv1 vulnerability (CVE-2017-0144), commonly known as EternalBlue. The rule monitors for specific SMB Trans2 SESSION_SETUP packet structures associated with this remote code execution exploit.
Detects network exploitation attempts targeting the SMBv1 protocol using the EternalBlue vulnerability (MS17-010). This vulnerability was famously exploited by the WannaCry and NotPetya ransomware to propagate across networks.
Detects network exploitation attempts targeting the SMBv1 protocol using the EternalBlue vulnerability (MS17-010). This vulnerability was famously exploited by the WannaCry and NotPetya ransomware to propagate across networks.
Detects network traffic attempting to exploit the SMBv1 vulnerability (CVE-2017-0144), commonly known as EternalBlue. The rule monitors for specific SMB Trans2 SESSION_SETUP packet structures associated with this remote code execution exploit.
EternalBlue SMB Exploit Attempt
Suricata
This rule detects attempts to exploit the EternalBlue vulnerability over SMB (Server Message Block) protocol. It specifically looks for a sequence of bytes indicative of the exploit payload within the SMB traffic.
KQL Query from file: Endpoint SMB Exposed on Public Internet
This YARA rule detects the NotPetya ransomware by identifying specific byte sequences (patterns) associated with its file encryption routine, main execution logic, encryption loop, and system shutdown/reboot mechanisms. The rule requires all four distinct byte patterns to be present within a file, along with the standard Windows PE header (MZ magic bytes), to trigger a detection. This combination of patterns aims to specifically identify NotPetya samples.
Yara rule that detects NotPetya ransomware.