Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
297 detections
Filters
Last updated
All Time
Detection languages
100
93
29
27
18
Contributors
58
47
44
26
18
Categories
90
82
78
61
59
Platforms
263
35
10
9
2
Products / Services
98
57
54
33
28
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
4
2
1
IDS Classtypes
11
7
5
3
1
IDS Protocols
20
7
Detects lateral movement behaviors associated with ransomware affiliates, including remote service creation using PsExec-style binaries or admin-share paths, command-line access to SMB admin shares, and enabling Remote Desktop Protocol via registry modifications or firewall rule updates.
Detects the first-seen external Remote Desktop Protocol (RDP) logon event for a specific user and network provider (ASN) within the last 24 hours, compared against a 14-day historical baseline. This can indicate initial access via compromised credentials or RDP exploitation.
Detects a sequence of suspicious activities including local account creation, modification of account security policies, and enabling of administrative services or credential exposure settings within a short time window. This typically indicates post-exploitation behavior where an adversary is attempting to establish persistence or facilitate further lateral movement.
Detects a potential post-compromise lateral movement sequence where a host, previously identified as accessing sensitive browser credential files by an unauthorized process, subsequently initiates RDP or WinRM connections to other internal hosts using an account not previously observed performing interactive logons on that source host.
Detects interactive RDP logons (LogonType 10) occurring on domain controllers or VDI authentication servers where the originating workstation name follows naming conventions associated with VDI/virtual-desktop environments. This pattern is indicative of potential lateral movement, where an adversary pivots from a compromised user VDI instance directly to sensitive infrastructure, bypassing established administrative jump box protocols.
This rule detects potential Remote Desktop Protocol (RDP) session hijacking or suspicious automation activity. It monitors for the execution of tscon.exe, a system utility used to control remote desktop sessions, or the usage of mstsc.exe (Remote Desktop Connection) over the standard RDP port 3389, which can be indicative of lateral movement or unauthorized access.
Detects anomalous lateral movement via Remote Desktop Protocol (RDP) by identifying three high-risk patterns: rapid RDP fan-out to multiple destination hosts from a single account, RDP access to sensitive servers from unauthorized source hosts, and RDP sessions followed by the execution of known post-exploitation or credential-theft tooling on the destination host.
Detects a sequence of multiple RDP authentication failures (Event ID 4625, Logon Type 10) from a specific source IP, followed by a successful RDP authentication (Event ID 4624, Logon Type 10) from the same source IP. This pattern indicates a successful credential brute force or password spraying attack against RDP, which is a common initial access vector for ransomware and lateral movement.
This rule detects potential identity-led lateral movement in two scenarios: 1) A single account performing RDP authentications to multiple distinct hosts within a short time frame (RDP Fan-Out), or 2) An RDP login occurring on a host shortly after evidence of LSASS process memory access on that same host, suggesting potential credential theft followed by immediate reuse.
Detects potential lateral movement by users who have recently been flagged for credential theft or infostealer activity. The rule correlates initial security alerts with subsequent Windows logon events (RDP, network/WinRM) or SMB share access, identifying users connecting to multiple distinct destinations within a 48-hour window.
This rule detects a credential-based attack where a single source IP performs multiple failed RDP (LogonType 3/10) attempts against various user accounts, followed by a successful authentication from the same source within an hour. This pattern is indicative of password spraying or brute-forcing followed by successful lateral movement via Remote Desktop.
Detects potential lateral movement by identifying users who have recently had a confirmed infostealer malware infection on a source host and subsequently initiate RDP or WinRM connections from a different host to internal network resources.
Detects interactive (Logon Type 10) or network (Logon Type 3) authentication to Windows hosts originating from external, non-RFC1918 IP addresses using 'Negotiate' authentication. This pattern is indicative of potential lateral movement from a cloud-connected environment into on-premises infrastructure, specifically where an adversary might be leveraging stolen session artifacts or credentials to bypass standard Kerberos-based domain authentication.
This rule monitors firewall logs for internal RDP (port 3389) connection attempts from a single source host to multiple destination hosts within internal address ranges. This pattern of sequential connectivity is often indicative of automated internal reconnaissance or lateral movement scanning using RDP.
Detects high-risk domain account activity, specifically identifying either impossible-travel authentication patterns in cloud logs or rapid, multi-host interactive authentication fan-out within one hour. These detections are further correlated with subsequent RDP or WinRM session establishment, indicating potential lateral movement or compromise of legitimate accounts.
Detects a single source IP address attempting to connect to multiple hosts over TCP port 3389 (RDP) within a short timeframe (10 attempts in 60 seconds). This behavior is indicative of a host scanning the network for accessible RDP services, a common precursor to lateral movement or brute force attacks.
This rule detects potential lateral movement via Remote Desktop Protocol (RDP) by identifying a single user account establishing RemoteInteractive (logon type 10) sessions to three or more distinct destination hosts within a 15-minute timeframe. This pattern is indicative of an attacker attempting to traverse a network from a compromised host.
Detects successful RDP (Remote Desktop Protocol) logon events (Event ID 4624, Logon Type 10) where the source IP address is outside the predefined internal network ranges. This behavior is indicative of potential lateral movement, where an attacker attempts to access internal systems from an external, non-corporate source.
Detects network traffic permitted from zones typically associated with NetScaler appliances (DMZ, perimeter, VPN, gateway) to sensitive internal zones (internal, trust, LAN, corp) using common administrative or lateral movement protocols (SMB, RDP, WinRM, RPC, LDAP). This behavior is indicative of potential lateral movement or exploitation originating from a compromised edge appliance.
Detects the specific pattern associated with Storm-2570 for enabling Remote Desktop Protocol (RDP) on a target host to facilitate lateral movement. The detection looks for registry modifications to disable RDP denial (fDenyTSConnections=0), firewall rules allowing TCP port 3389 via netsh or PowerShell, and the deployment of these configurations using PsExec against a target host list file.
Detects a potential post-compromise lateral movement sequence where a host, previously identified as accessing sensitive browser credential files by an unauthorized process, subsequently initiates RDP or WinRM connections to other internal hosts using an account not previously observed performing interactive logons on that source host.
Page 1 of 15