Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
509 detections
Filters
Last updated
All Time
Detection languages
178
171
34
34
27
Contributors
111
85
80
49
32
Categories
182
138
137
114
63
Platforms
488
30
19
6
2
Products / Services
175
95
90
57
51
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
5
4
1
1
1
IDS Classtypes
23
4
2
1
1
IDS Protocols
27
6
Detects reuse of alternate authentication materials like tokens or cookies
Detects remote creation or modification of system processes for persistence
Detects remote modification of file and directory permissions via SMB
Detects high-volume RPC endpoint mapper requests indicating inter-process communication abuse
This rule detects suspicious access patterns to Windows administrative shares (C$, D$, E$, IPC$, ADMIN$). It specifically looks for multiple access attempts (10 or more within an hour) involving read or write operations (AccessMask contains '0x0001' or '0x0002') from a single source IP address and account. This behavior can indicate lateral movement, data exfiltration, or other malicious activity.
Detects enumeration of group memberships for permission group discovery
This rule detects attempts to modify Group Policy Objects (GPOs) over Server Message Block (SMB) by looking for HTTP PUT requests containing '\SYSVOL\' and '\Policies\' in the URI. This activity can indicate an adversary attempting to escalate privileges or establish persistence within an Active Directory domain.
This rule detects a high volume of network share connections (SMB/CIFS) from a single device to multiple remote IPs within a short timeframe. This behavior can be indicative of ransomware attempting to encrypt files across network shares, or other forms of rapid lateral movement and data access. The rule specifically looks for connections on ports 445 or 139 initiated by common user or system processes like explorer.exe, cmd.exe, or powershell.exe.
This rule detects suspicious access patterns to Windows administrative shares (C$, D$, E$, IPC$, ADMIN$). It specifically looks for multiple access attempts (10 or more within an hour) involving read or write operations (AccessMask contains '0x0001' or '0x0002') from a single source IP address and account. This behavior can indicate lateral movement, data exfiltration, or other malicious activity.
This rule detects attempts to exploit the PrintNightmare vulnerability over SMB. It specifically looks for network traffic on port 445 (SMB) containing the strings "spoolss" and "RpcAddPrinterDriverEx" in a case-insensitive manner, indicating an attempt to leverage the Print Spooler service for privilege escalation.
This rule detects attempts to drop a DLL file to a network share, specifically targeting the 'ADMIN$' share, which could indicate a DLL hijacking attempt. It monitors SMB traffic on port 445 for established connections and looks for content containing '.dll' and 'ADMIN$' (case-insensitive).
This rule detects attempts to discover Group Policy information remotely over Server Message Block (SMB). It specifically looks for network traffic on port 445 (SMB) containing the strings "SYSVOL" and "GroupPolicy" (case-insensitive) in the same flow, indicating a potential query for Group Policy objects.
This rule detects attempts to drop executable files (.exe) into shared network folders (specifically those containing '\share\') over SMB (Server Message Block) protocol. This activity is indicative of an attacker attempting to move tools or malware laterally within a network.
This rule detects outbound Server Message Block (SMB) communications from internal devices to external (non-private) IP addresses. It specifically looks for connections on ports 137, 138, 139, and 445. The rule then aggregates these events over 10-minute intervals and flags devices that have more than 5 such SMB connections to distinct external IPs, indicating potential data exfiltration or unauthorized external communication.
This rule detects attempts to modify the remote registry via Server Message Block (SMB) by looking for the strings "winreg" and "RegSetValue" in TCP traffic destined for port 445 on the home network. This activity could indicate an attacker attempting to establish persistence, elevate privileges, or evade defenses by altering system configurations.
This rule detects internal Server Message Block (SMB) lateral movement attempts. It triggers when there are 10 or more SMB connections (identified by the "|FF|SMB" content signature) from a single source IP address to any destination on port 445 within a 60-second window, within the home network. This behavior is indicative of an attacker attempting to move laterally within a network using SMB.
This rule detects a high volume of network share connections (SMB/CIFS) from a single device to multiple remote IPs within a short timeframe. This behavior can be indicative of ransomware attempting to encrypt files across network shares, or other forms of rapid lateral movement and data access. The rule specifically looks for connections on ports 445 or 139 initiated by common user or system processes like explorer.exe, cmd.exe, or powershell.exe.
This rule detects the execution of PsExec or similar tools (psexec.exe, psexec64.exe, paexec.exe) which are commonly used for lateral movement within a network. It also identifies the use of PsExec service (psexesvc.exe) or command-line arguments indicative of PsExec activity, such as accessing administrative shares (ADMIN$, C$, IPC$) or the '-accepteula' flag.
Detects potentially malicious SMB activity associated with GhostLock-style
availability attacks. This analytic identifies suspicious SMB access patterns
where scripting engines or uncommon SMB client processes initiate large numbers
of SMB connections and file open operations without corresponding write activity.
GhostLock abuses Windows file locking semantics by opening files on SMB shares
using exclusive deny-share handles, preventing legitimate access without
encrypting, renaming, or modifying the underlying files.
This rule is intended as a detection building block and should be correlated
in the SIEM to identify:
- High SMB FILE_OPEN volume
- Zero SMB FILE_WRITE activity
- Long-lived SMB sessions or handles
- Repeated activity from a single source host or account
Recommended correlation logic:
- Group by source IP, username, and destination server
- SMB FILE_OPEN count > 1000
- SMB FILE_WRITE count == 0
- Time window: 15-30 minutes
availability attacks. This analytic identifies suspicious SMB access patterns
where scripting engines or uncommon SMB client processes initiate large numbers
of SMB connections and file open operations without corresponding write activity.
GhostLock abuses Windows file locking semantics by opening files on SMB shares
using exclusive deny-share handles, preventing legitimate access without
encrypting, renaming, or modifying the underlying files.
This rule is intended as a detection building block and should be correlated
in the SIEM to identify:
- High SMB FILE_OPEN volume
- Zero SMB FILE_WRITE activity
- Long-lived SMB sessions or handles
- Repeated activity from a single source host or account
Recommended correlation logic:
- Group by source IP, username, and destination server
- SMB FILE_OPEN count > 1000
- SMB FILE_WRITE count == 0
- Time window: 15-30 minutes
Detects access to sensitive files, credential data, or remote procedure call (RPC) endpoints related to credential dumping over a network share.
This could indicate lateral movement or remote credential harvesting techniques.
This could indicate lateral movement or remote credential harvesting techniques.
https://thehackernews.com/2026/04/microsoft-confirms-active-exploitation.html
Page 14 of 25