Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
252 detections
Filters
Last updated
All Time
Detection languages
142
46
17
11
10
Contributors
63
31
24
23
23
Categories
78
69
67
67
49
Platforms
192
32
25
13
7
Products / Services
70
64
19
19
11
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
CVEs
1
1
1
1
1
IDS Classtypes
5
2
IDS Protocols
4
FortiGate Allowed RDP Connection
Cortex XDR
Detects network traffic identified by FortiGate as Remote Desktop Protocol (RDP) that has been explicitly permitted (Accept action) by the firewall policy. This rule monitors for successful packet flow through the firewall, providing visibility into potential lateral movement paths via RDP.
Detects a root-privileged child process spawned from screensharingd with no corresponding authorization/sudo prompt, indicating privilege escalation via the post-auth logic flaw CVE-2026-43760.
Detects successful SSH authentication to a Linux system using public-key authentication by monitoring system logs for the 'Accepted publickey for' message. This rule identifies remote access attempts and serves as a foundation for monitoring lateral movement via SSH.
This Defender XDR query detects high-confidence attempts to export certificates with private keys using native Windows utilities, PowerShell, Mimikatz, AADInternals, Certipy, OpenSSL, and certificate-management tools.
KQL Query from file: Hunting Mirage kitten AKA unc1549
Detects Abyssos RAT modules (DCFINDER, VULNSCAN, ELEVATE_SYS_TOKEN, RDPWRAP) by requiring a shared XOR/AES-CBC key alongside a temp-folder write using a module-specific short prefix (dcf, vul, plg, rdp) that is followed by execution via an anomalous export function name (abyss or the module-specific Get*Text/Json exports)
This rule detects potential lateral movement attempts originating from IIS web servers (identified by 'w3wp.exe' as the initiating process) to other internal IP addresses using common lateral movement ports (SMB, RDP, WinRM, SSH). It specifically looks for successful network connections from an IIS server to a private IP address on one of the specified ports, where the remote IP is not the local IP.
This rule detects potential reverse shell command execution by monitoring process creation events (EventID 4688) for specific command-line strings commonly associated with reverse shells. It looks for 'bash -i', '/bin/bash', 'nc -e', and 'powershell -NoP' in the command line.
This rule detects suspicious network connections originating from internal IP addresses to common service ports (DNS, SMB, RDP, WinRM) on remote, non-internal IP addresses. It flags instances where a single process on a device makes 10 or more such connections within an hour, which could indicate reconnaissance, lateral movement, or data exfiltration attempts.
This rule detects the execution of the QEMU virtualization engine (qemu-system-x86_64.exe) when associated with specific toolset files (e.g., BloodHound, Metasploit) or suspicious network activity patterns indicative of lateral movement, such as connecting to administrative ports (SMB, RDP, WinRM) on external or sensitive network ranges. The rule calculates a risk score based on the presence of these indicators.
This rule detects successful authentication attempts directed at network devices from sources not explicitly marked as authorized management systems. It identifies users or systems that are not recognized service accounts authenticating against network infrastructure and flags activity that involves multiple unique destination targets as high risk.
Detects the simultaneous execution of QEMU virtualization processes and post-exploitation tools (Metasploit, Impacket, Havoc, NXC) on the same host. This combination is indicative of an adversary using a local virtual machine to tunnel or pivot lateral movement activities while leveraging post-exploitation frameworks on the host system, a behavior observed in specific campaigns.
This rule detects suspicious access patterns to Windows administrative shares (C$, D$, E$, IPC$, ADMIN$). It specifically looks for multiple access attempts (10 or more within an hour) involving read or write operations (AccessMask contains '0x0001' or '0x0002') from a single source IP address and account. This behavior can indicate lateral movement, data exfiltration, or other malicious activity.
This rule detects potential lateral movement activity by identifying a single user account attempting to log on to five or more distinct computers with at least ten logon attempts within a five-minute window. It specifically looks for successful logons (EventID 4624) with network, remote interactive, or remote desktop logon types (LogonType 3, 9, 10) and excludes machine accounts (TargetUserName not ending with '$'). This pattern can indicate an adversary attempting to spread across the network using compromised credentials.
Detects unusual network connections or process creation events originating from the 'sharingd' daemon on macOS. 'sharingd' handles various Apple sharing features (AirDrop, Handoff, Shared Clipboard). Unusual child processes or network activity involving this daemon may indicate abuse for unauthorized data transfer, lateral movement, or remote service interaction.
Detects the execution of scripting interpreters and remote management tools originating from the SimpleHelp RMM process tree. This activity is indicative of post-exploitation abuse where an attacker, having hijacked a technician session (e.g., via CVE-2026-48558 OIDC bypass), uses the RMM console to execute commands on remote endpoints.
Detects the execution of NetExec (formerly CrackMapExec) binaries, associated named pipe creation, and suspicious bursts of authentication activity indicating potential lateral movement or password spraying attacks.
Detects suspicious usage of remote execution tools like PsExec, WMIC, and PowerShell, which are commonly used for lateral movement by adversaries. The rule identifies instances where these tools are executed multiple times within a short period (more than 2 times in 5 minutes) from non-system accounts and outside of standard system directories, indicating potential malicious activity.
This rule detects a high volume of remote desktop session changes (logon/logoff) for a single user within a one-hour window. Event IDs 4778 and 4779 indicate a session reconnected or disconnected, respectively. A high count (>=10) could suggest suspicious activity such as session hijacking, rapid reconnections by an attacker, or automated tools interacting with remote sessions.
This rule detects a high volume (5 or more within an hour) of process creation events where the command line contains keywords associated with remote access protocols like DCOM, WMI, or RPC. This could indicate an adversary utilizing these protocols for lateral movement or remote execution.
Detects an internet-facing host in the DMZ that receives an inbound connection from an external non-RFC1918 address and subsequently authenticates to an internal RFC1918 host within a one-hour window. This behavior is indicative of a compromised DMZ host being used as a pivot point for lateral movement into the internal network.
Page 3 of 12