Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
19 detections
Filters
Last updated
All Time
Detection languages
10
4
3
1
1
Contributors
8
3
2
2
2
Categories
12
8
5
2
2
Platforms
18
2
Products / Services
4
4
4
3
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
This rule detects the execution of known offensive security and post-exploitation toolsets (such as Impacket, Metasploit, CrackMapExec, or NetExec) when initiated from virtualization processes like QEMU. This pattern is indicative of an adversary executing malicious payloads from within a virtual machine or using virtualization software as a proxy for malicious activity on the host.
This rule monitors process execution events for the presence of known penetration testing and post-exploitation tools, specifically NetExec (formerly CrackMapExec), nxc, or cme. These tools are frequently used by adversaries for network discovery, lateral movement, and credential harvesting within Active Directory environments.
Detects the execution of NetExec (formerly CrackMapExec) binaries, associated named pipe creation, and suspicious bursts of authentication activity indicating potential lateral movement or password spraying attacks.
This rule detects the execution of common remote execution and lateral movement tools by monitoring process command lines for specific keywords. The tools include pth-winexe, crackmapexec, impacket, smbexec, and wmiexec, which are frequently used by adversaries for remote code execution and network reconnaissance.
This rule detects the execution of common remote execution and lateral movement tools by monitoring process command lines for specific keywords. The tools include pth-winexe, crackmapexec, impacket, smbexec, and wmiexec, which are frequently used by adversaries for remote code execution and privilege escalation.
Detects Pass-the-Hash attacks using NTLM authentication over SMB
Detects various execution patterns associated with the CrackMapExec (CME) pentesting framework. This includes specific command-line arguments used by CME for remote command execution via `cmd.exe` (targeting WMI or scheduled tasks for output redirection) and PowerShell execution with common obfuscation or encoding techniques.
The following analytic detects the creation of a Scheduled Task with a high entropy, randomly generated name, leveraging Event ID 4698. It uses the `ut_shannon` function from the URL ToolBox Splunk application to measure the entropy of the Task Name. This activity is significant as adversaries often use randomly named Scheduled Tasks for lateral movement and remote code execution, employing tools like Impacket or CrackMapExec. If confirmed malicious, this could allow attackers to execute arbitrary code remotely, potentially leading to further compromise and persistence within the network.
CrackMapExecWin
Sigma
Detects CrackMapExecWin Activity as Described by NCSC
CrackMapExecWin
Sigma
Detects CrackMapExecWin Activity as Described by NCSC
Dragon Fly
KQL
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_dragonfly.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
Detects the creation of temporary files with specific naming conventions (8 alphanumeric characters followed by '.tmp') in the 'C:\Windows\System32\' directory, when the creating process is 'svchost.exe'. This pattern is indicative of remote credential dumping activity often associated with tools like CrackMapExec and Impacket-secretsdump, which use svchost.exe to write temporary files containing dumped credentials.
Detects the creation of files with specific naming patterns and paths commonly used by the post-exploitation tool CrackMapExec. This includes PowerShell scripts like 'temp.ps1' and 'msol.ps1' in the 'C:\Windows\Temp\' directory, as well as temporary files with UUID-like or 8-character alphanumeric names.
The analytic detects the use of NetExec (formerly CrackMapExec), a toolset for post-exploitation enumeration and attack within Active Directory environments, by identifying specific command-line arguments. It leverages Endpoint Detection and Response (EDR) data to detect actions like ticket manipulation, Kerberoasting, and password spraying. This activity is significant as NetExec is used by adversaries to exploit Kerberos for privilege escalation and lateral movement, potentially leading to unauthorized access, persistence, and compromise of sensitive information.
This rule detects the execution of various known hacktools on Linux systems by monitoring process creation events and matching against a predefined list of tool names in the 'Image' field. The tools covered include C2 frameworks (e.g., Cobalt Strike, Metasploit, Havoc, Merlin, Sliver), network scanners (e.g., Nmap derivatives, Nuclei, Recon-ng), web enumeration tools (e.g., Dirb, Ffuf, Gobuster), web vulnerability scanners (e.g., Nikto, WPSCan), and other exploit/post-exploitation tools (e.g., Aircrack-ng, Bloodhound-Python, Hashcat, Hydra, John, SQLMap, PEASS-ng).
Detects the creation of named pipes that have been observed in use by known APT groups or malware. This rule specifically looks for a predefined list of pipe names associated with various malicious activities, including those used by Project Sauron, SolarWinds SUNBURST, LiquidSnake, Turla HyperStack, Sofacy group malware, Hidden Cobra Hoplight, Pacifier, Snatch Ransomware, Covenant, Qbot, Uroburos Malware, PoshC2, Wild Neutron, Cloud Hopper (RedLeaves), Equation Group malware, Cobra Trojan, Crackmapexec, and Emissary Panda (Hyperbro).
This rule detects the execution of PowerShell with specific command-line obfuscation patterns known to be used by the CrackMapExec (CME) penetration testing framework. The rule looks for PowerShell executable names and specific string patterns within the command line that CME uses for obfuscation, such as 'join*split', '( $ShellId[1]+$ShellId[13]+''x'')', '( $PSHome[*]+$PSHOME[*]+', '( $env:Public[13]+$env:Public[5]+''x'')', and '( $env:ComSpec[4,*,25]-Join'''')'. These patterns are designed to evade simple string-based detections.
Detects suspicious process patterns indicative of CrackMapExec (CME) being used to dump LSASS credentials. The rule looks for specific command-line arguments used by CME for LSASS dumping, including combinations of 'tasklist' with 'Imagename eq lsass.exe', 'rundll32.exe' with 'comsvcs.dll' and temporary paths, and 'tasklist' with 'findstr /i "lsass"'. These patterns are commonly observed when attackers attempt to extract credentials from the Local Security Authority Subsystem Service (LSASS) process memory.
This rule detects common flag combinations used by CrackMapExec, a post-exploitation tool, to identify its execution even if the binary name has been changed. It looks for specific command-line arguments related to local authentication, hash-based authentication, and module usage for SMB and MSSQL protocols.