Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
509 detections
Filters
Last updated
All Time
Detection languages
178
171
34
34
27
Contributors
111
85
80
49
32
Categories
182
138
137
114
63
Platforms
488
30
19
6
2
Products / Services
175
95
90
57
51
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
5
4
1
1
1
IDS Classtypes
23
4
2
1
1
IDS Protocols
27
6
Detects bulk file reading from network shares for data collection
This rule detects unusual outbound Server Message Block (SMB) traffic originating from common Windows processes (explorer.exe, svchost.exe, system.exe) to external IP addresses (not RFC1918 private ranges). It triggers if a device makes 5 or more SMB connections to unique remote IPs within an hour. This could indicate lateral movement, data exfiltration, or other malicious activity.
Detects bulk registry queries over SMB for system discovery
Detects bulk file reading from network shares for data collection
This rule detects multiple access attempts to administrative SMB shares (C$, D$, E$, ADMIN$, IPC$) from a single source IP address within a 5-minute window. This behavior can be indicative of lateral movement, reconnaissance, or ransomware activity attempting to spread across a network by accessing critical shares.
Detects enumeration of Group Policy Objects through SYSVOL share access
Detects SMB NTLM relay attacks used for credential capture and lateral movement
Detects bulk registry queries over SMB for system discovery
Detects inbound RPC calls to the Service Control Manager interface with operation numbers corresponding to service creation and modification, which may indicate lateral movement via remote service installation.
Detects data staged on remote network shares prior to exfiltration
Detects creation of new local accounts via SMB for persistent access
This rule detects a high volume of access attempts to the IPC$ administrative share from a single source IP address within a one-hour window. This behavior can be indicative of reconnaissance, lateral movement, or other malicious activities using SMB/Windows Admin Shares.
Detects lateral movement attempts using SMB administrative shares
This rule detects a high volume of access attempts (5 or more within an hour) to administrative shares (C$, D$, E$, ADMIN$) from a single source IP address. This activity can be indicative of lateral movement, data exfiltration, or reconnaissance by an adversary attempting to gain access to sensitive information or spread malware across the network.
This rule detects a high volume of activity (10 or more events within an hour) to Windows administrative shares (C$, IPC$, ADMIN$) from a single source IP address. This behavior can indicate lateral movement, data exfiltration, or other malicious activity using legitimate administrative functions.
This rule detects a high volume of activity (10 or more events within an hour) to Windows administrative shares (C$, IPC$, ADMIN$) from a single source IP address. This behavior can indicate lateral movement, data exfiltration, or other malicious activity using legitimate administrative functions.
This rule detects outbound Server Message Block (SMB) communications from internal devices to external (non-private) IP addresses. It specifically looks for connections on ports 137, 138, 139, and 445. The rule then aggregates these events over 10-minute intervals and flags devices that have more than 5 such SMB connections to distinct external IPs, indicating potential data exfiltration or unauthorized external communication.
Detects inbound RPC calls to the Service Control Manager interface with operation numbers corresponding to service creation and modification, which may indicate lateral movement via remote service installation.
This rule detects potential reverse shell command execution by monitoring process creation events (EventID 4688) for specific command-line strings commonly associated with reverse shells. It looks for 'bash -i', '/bin/bash', 'nc -e', and 'powershell -NoP' in the command line.
This rule detects attempts to remotely install Windows services over Server Message Block (SMB). It specifically looks for network traffic on port 445 (SMB) containing the strings "svcctl" and "CreateService" in a case-insensitive manner, indicating a service control request to create a new service. This activity is often associated with adversaries establishing persistence on a compromised system.
This rule detects an unusually high volume of successful network connections over SMB (ports 135, 139, 445) originating from a single account within a one-hour window. This behavior can be indicative of lateral movement, reconnaissance, or data exfiltration activities using SMB/RPC.
Page 13 of 25