Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
509 detections
Filters
Last updated
All Time
Detection languages
178
171
34
34
27
Contributors
111
85
80
49
32
Categories
182
138
137
114
63
Platforms
488
30
19
6
2
Products / Services
175
95
90
57
51
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
5
4
1
1
1
IDS Classtypes
23
4
2
1
1
IDS Protocols
27
6
Detects execution of PsExec or PsExec64 using the -accepteula flag targeting a remote host specified by a Universal Naming Convention (UNC) path. This pattern is commonly used for legitimate remote administration but is also a hallmark of lateral movement and remote code execution by attackers.
Detects the use of the sc.exe utility to create a new service on a remote system by specifying a path using a UNC share. This behavior is indicative of lateral movement, where an attacker attempts to execute code on a remote host by installing a service via SMB/Admin Shares.
Detects execution of PsExec or PsExec64 using the -accepteula flag targeting a remote host specified by a Universal Naming Convention (UNC) path. This pattern is commonly used for legitimate remote administration but is also a hallmark of lateral movement and remote code execution by attackers.
This rule monitors for a sequential attack chain occurring within a 15-minute window. It links a high-risk or risky user sign-in to subsequent reconnaissance (whoami, ipconfig), credential access (LSASS dumping, registry hive export), and lateral movement (network connections over port 445).
This rule monitors for a sequential attack chain occurring within a 15-minute window. It links a high-risk or risky user sign-in to subsequent reconnaissance (whoami, ipconfig), credential access (LSASS dumping, registry hive export), and lateral movement (network connections over port 445).
Detects LCRYX ransomware components attempting to propagate through the network using WMI Win32_Process execution over SMB admin shares, and monitors for the creation of USB_bridge.vbs scripts, commonly associated with removable media infection vectors.
Detects creation or restoration of ADMIN$, C$, or custom hidden shares used for remote ransomware deployment. This rule specifically looks for `net.exe`, `powershell.exe`, or `cmd.exe` executing commands that create or modify SMB shares, targeting administrative shares like ADMIN$, C$, or any share ending with a dollar sign ($).
This rule detects potential lateral movement activity by identifying devices that establish connections to three or more distinct remote IP addresses via SMB/CIFS ports (445 or 139) within a one-hour window. The query excludes internal network ranges (10.x.x.x and 192.168.x.x) to focus on connections that may be traversing network boundaries or reaching out to segments that might indicate unauthorized discovery or movement.
This rule detects connection attempts to common administrative and remote access ports (RDP, SSH, SMB, RPC) from non-internal IP address ranges. Such activity may indicate an attempt to bypass Zero-Trust network policies or unauthorized remote access attempts from external or untrusted segments.
This rule detects a pattern of network shared folder access followed by the execution of known ransomware executables ('servertool.exe', 'encrypt.exe') within a 45-minute window. This behavior is indicative of ransomware preparing to encrypt data on network shares.
Detects InstallService.exe making outbound network connections over port 445 (SMB) to external or untrusted IPs. This activity could indicate an attempt to coerce authentication or establish remote access.
Detects the execution of PsExec (psexec.exe or psexec64.exe) with command-line arguments indicating remote execution to a network share and the use of administrative credentials (e.g., -s, -u, -p, -c). This activity is often associated with lateral movement and remote service execution by attackers, including ransomware groups like 'The Gentlemen'.
Detects attempts to discover network shares and remote systems using 'net share', 'net view' commands, or by accessing UNC paths with extended path prefixes, which can be indicative of lateral movement or reconnaissance activities.
Identifies the SimpleHelp service initiating unusually heavy outbound SMB (port 445) traffic, indicating lateral movement or ransomware propagation across the network.
Detects copying executables, scripts, or archives to a remote C$ share immediately before remote execution. This behavior is associated with the 'Gentlemen Ransomware' as described in the referenced Microsoft blog.
Detects the execution of Invoke-SMBRemoting for fileless lateral movement, specifically looking for PowerShell processes with 'Invoke-SMBRemoting' in their command line.
This rule detects unusual outbound Server Message Block (SMB) traffic originating from common Windows processes (explorer.exe, svchost.exe, system.exe) to external IP addresses (not RFC1918 private ranges). It triggers if a device makes 5 or more SMB connections to unique remote IPs within an hour. This could indicate lateral movement, data exfiltration, or other malicious activity.
This rule detects potential ransomware lateral movement patterns by correlating specific network connection attempts (SMB/RDP/RPC) with the observed creation of files having the '.prinzeugen' extension on the same host within a 2-hour window. This behavior is indicative of a ransomware strain propagating across the network and performing encryption.
Detects the SMBExec lateral movement pattern where a command is echoed to a temporary .bat file and then immediately deleted. This technique often involves using `cmd.exe` to write and execute commands on a remote system via administrative shares.
This rule detects multiple access attempts to administrative SMB shares (C$, D$, E$, ADMIN$, IPC$) from a single source IP address within a 5-minute window. This behavior can be indicative of lateral movement, reconnaissance, or ransomware activity attempting to spread across a network by accessing critical shares.
Detects transfer of offensive tools to lateral movement targets via SMB
Page 12 of 25