Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
509 detections
Filters
Last updated
All Time
Detection languages
178
171
34
34
27
Contributors
111
85
80
49
32
Categories
182
138
137
114
63
Platforms
488
30
19
6
2
Products / Services
175
95
90
57
51
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
5
4
1
1
1
IDS Classtypes
23
4
2
1
1
IDS Protocols
27
6
Detects the creation or modification of services associated with PsExec, a legitimate tool often abused by adversaries for remote execution. The rule looks for specific service names or file paths indicative of PsExec activity, including the default 'PSEXESVC' service name, or file paths containing 'ADMIN$' or 'IPC$' shares, or a randomly named executable in the SystemRoot directory. It filters out activity from designated administrative workstations and common system accounts.
This rule detects the creation of named pipes associated with known command-and-control (C2) frameworks, post-exploitation toolkits, and suspicious system activity. By filtering out common legitimate system processes and monitoring for specific pipe patterns (e.g., Cobalt Strike, Metasploit, PsExec, and sensitive RPC endpoints), the rule identifies potential lateral movement, remote execution, and post-exploitation communication channels.
Detects the execution of Impacket framework scripts (secretsdump, ntlmrelayx, psexec, wmiexec, smbexec) from a portable directory path named 'mini_imp'. This pattern is associated with credential dumping from LSASS and unauthorized lateral movement activities, similar to those observed in Operation Escaneo.
Detects behavior patterns associated with the LCRYX ransomware, specifically lateral movement via WMI (wmic.exe), network subnet scanning, file copy operations to remote SMB shares, and the dropping or execution of VBScript artifacts on removable or non-system drives.
This rule detects successful network logons (LogonType 3) using NTLM (NTLMv1 or NTLMv2) where the authentication results in an elevated token and the logon originates from a different workstation than the target computer. This combination of factors can indicate lateral movement attempts, especially when an adversary has obtained NTLM hashes (e.g., via Pass-the-Hash or NTLM relay attacks) and is attempting to authenticate to other systems on the network. The rule excludes machine accounts and anonymous logons, as well as loopback authentications, to reduce noise.
This rule correlates three distinct events to detect a potential credential theft and lateral movement chain: an LSASS credential dump, followed by an NTLM network logon, and then a DCOM activation of mmc.exe with the '-Embedding' flag on the target system. This sequence of events is indicative of an attacker compromising credentials, using them to move laterally, and then potentially executing further commands or tools via DCOM.
This rule detects a high frequency of successful network connections from a single device to multiple unique destination IP addresses within a one-hour window. The targeted ports (445, 139, 3389, 22, 21) are commonly used for remote administrative access, file transfers, and remote shell services, which are frequently leveraged by adversaries for lateral movement. The threshold of 3 unique targets in an hour may indicate automated scanning or credential brute-forcing activity across the network.
This rule detects potential lateral movement activity by identifying devices that establish connections to three or more distinct remote IP addresses via SMB/CIFS ports (445 or 139) within a one-hour window. The query excludes internal network ranges (10.x.x.x and 192.168.x.x) to focus on connections that may be traversing network boundaries or reaching out to segments that might indicate unauthorized discovery or movement.
This rule detects connection attempts to common administrative and remote access ports (RDP, SSH, SMB, RPC) from non-internal IP address ranges. Such activity may indicate an attempt to bypass Zero-Trust network policies or unauthorized remote access attempts from external or untrusted segments.
Detects use of Impacket tooling (wmiexec, psexec, smbexec, atexec, secretsdump) for lateral movement and remote service execution.
Detects use of Impacket tooling (wmiexec, psexec, smbexec, atexec, secretsdump) for lateral movement and remote service execution, as observed in Operation Escaneo attributed to MexicanMafia targeting LatAm critical infrastructure. The rule identifies Impacket activity through process command lines, service installations, and network connections to SMB (port 445) and DCOM (port 135) from Python or Impacket-related executables.
This rule detects potential ransomware lateral movement patterns by correlating specific network connection attempts (SMB/RDP/RPC) with the observed creation of files having the '.prinzeugen' extension on the same host within a 2-hour window. This behavior is indicative of a ransomware strain propagating across the network and performing encryption.
This rule detects a pattern of network shared folder access followed by the execution of known ransomware executables ('servertool.exe', 'encrypt.exe') within a 45-minute window. This behavior is indicative of ransomware preparing to encrypt data on network shares.
This rule detects a process performing a high volume of file write operations to UNC paths within a short timeframe. It further filters for processes that lack metadata such as company information, description, or digital signatures, and do not load common system DLLs, which is often indicative of potentially malicious or unpacked code attempting to encrypt or exfiltrate data across a network.
This rule detects a process performing a high volume of file write operations to UNC paths within a short timeframe. It further filters for processes that lack metadata such as company information, description, or digital signatures, and do not load common system DLLs, which is often indicative of potentially malicious or unpacked code attempting to encrypt or exfiltrate data across a network.
This rule detects a process performing a high volume of file write operations to UNC paths within a short timeframe. It further filters for processes that lack metadata such as company information, description, or digital signatures, and do not load common system DLLs, which is often indicative of potentially malicious or unpacked code attempting to encrypt or exfiltrate data across a network.
This rule detects network activity associated with lateral movement using Windows Management Instrumentation (WMI). It specifically looks for a DCE/RPC Bind request that targets the IWbemServices interface UUID, a common method for initializing remote WMI connections to execute commands on remote systems.
Maps the TiFlux agent initiating outbound SMB (port 445) connections to other local administrative shares, indicating active lateral movement.
Detects the use of Wscript.exe or Cscript.exe to spawn wmic.exe with arguments indicative of remote WMI execution, such as 'Win32_Process', 'process call create', or '/node:'. This pattern is frequently associated with lateral movement, worm propagation (like VBScript-based malware), and ransomware deployment.
Detects the creation or modification of services associated with PsExec, a legitimate tool often abused by adversaries for remote execution. The rule looks for specific service names or file paths indicative of PsExec activity, including the default 'PSEXESVC' service name, or file paths containing 'ADMIN$' or 'IPC$' shares, or a randomly named executable in the SystemRoot directory. It filters out activity from designated administrative workstations and common system accounts.
Detects a loop attempting 'net use' against multiple IPC$ shares and recording reachable SMB hosts. This activity is indicative of network reconnaissance, specifically looking for accessible shares on remote systems within a subnet.
Page 11 of 25