Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
509 detections
Filters
Last updated
All Time
Detection languages
178
171
34
34
27
Contributors
111
85
80
49
32
Categories
182
138
137
114
63
Platforms
488
30
19
6
2
Products / Services
175
95
90
57
51
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
5
4
1
1
1
IDS Classtypes
23
4
2
1
1
IDS Protocols
27
6
Detects the use of PowerShell to re-enable the deprecated and vulnerable SMB1 protocol. This protocol is often used by attackers for lateral movement to legacy systems, as highlighted by groups like The Gentlemen RaaS.
Detects AdaptixC2 framework behaviors by correlating DNS over HTTPS (DoH) lookups to known providers (dns.google, dns.quad9) with subsequent Beacon Object File (BOF) activities. It specifically looks for the same process performing the DoH lookup and subsequently executing LSASS dumping commands, spawning sacrificial BOF processes, or initiating SMB/WinRM lateral movement.
Detects AdaptixC2 framework behaviors by correlating DNS over HTTPS (DoH) lookups to known providers (dns.google, dns.quad9) with subsequent Beacon Object File (BOF) activities. It specifically looks for the same process performing the DoH lookup and subsequently executing LSASS dumping commands, spawning sacrificial BOF processes, or initiating SMB/WinRM lateral movement.
Detects AdaptixC2 framework behaviors by correlating DNS over HTTPS (DoH) lookups to known providers (dns.google, dns.quad9) with subsequent Beacon Object File (BOF) activities. It specifically looks for the same process performing the DoH lookup and subsequently executing LSASS dumping commands, spawning sacrificial BOF processes, or initiating SMB/WinRM lateral movement.
Detects execution of Impacket's MSSQL client tool, commonly used for lateral movement against Microsoft SQL servers using compromised credentials. Includes detection of proxychains usage and Python-based execution patterns.
Detects command-line activity indicative of mounting a remote WebDAV share, a technique used to bypass browser security controls and deliver malware. This rule looks for specific keywords used to force a connection to a remote WebDAV server.
Detects a when net.exe is called with a password in the command line
Detects file creation events indicating NetExec (nxc.exe) execution on the local machine.
NetExec is a PyInstaller-bundled binary that extracts its embedded data files to a "_MEI<random>" directory
under the Temp folder upon execution. Files dropped under the "\nxc\" sub-directory of that
extraction path are unique to NetExec and serve as reliable on-disk indicators of execution.
NetExec (formerly CrackMapExec) is a widely used post-exploitation and lateral movement tool used for
Active Directory enumeration, credential harvesting, and remote code execution.
NetExec is a PyInstaller-bundled binary that extracts its embedded data files to a "_MEI<random>" directory
under the Temp folder upon execution. Files dropped under the "\nxc\" sub-directory of that
extraction path are unique to NetExec and serve as reliable on-disk indicators of execution.
NetExec (formerly CrackMapExec) is a widely used post-exploitation and lateral movement tool used for
Active Directory enumeration, credential harvesting, and remote code execution.
This rule detects suspicious activity involving the WebDAV client, specifically looking for scenarios where WebDAV connections to public IPs are initiated from a process that has recently modified the RunMRU registry key to include WebDAV parameters and executables like 'cmd' or 'net use', and has also accessed clipboard data. This combination of behaviors suggests potential credential theft or lateral movement attempts using WebDAV.
Detects lateral movement attempts using SMB administrative shares via Network Connection
Detects command-line activity indicative of mounting a remote WebDAV share, a technique used to bypass browser security controls and deliver malware. This rule looks for specific keywords used to force a connection to a remote WebDAV server.
This rule detects the execution of PsExec or similar tools (psexec.exe, psexec64.exe, paexec.exe) which are commonly used for lateral movement within a network. It also identifies the use of PsExec service (psexesvc.exe) or command-line arguments indicative of PsExec activity, such as accessing administrative shares (ADMIN$, C$, IPC$) or the '-accepteula' flag.
Active Directory serves as the central repository for an organization's authentication infrastructure. Malicious actors frequently focus on obtaining the NTDS.dit database file, which holds encrypted password data and essential domain configuration. Successful acquisition of this file can lead to complete organizational compromise.
This rule detects the creation of a process that involves 'qemu' in its image path and contains 'hostfwd=tcp' along with either 'vault.db' or 'bisrv.dll' in its command line. This combination is indicative of an SSH backdoor deployment, specifically observed in the context of SolarWinds Web Help Desk exploitation where threat actors establish persistence using a scheduled task named TPMProfiler to execute QEMU with an SSH port forward.
Detects when the 'AllowNetworkLocations' or 'AllowSubfolders' registry values are enabled for Microsoft Office. This change broadens the attack surface by allowing Office to trust documents from network shares or any subdirectory within a trusted path, which can be abused by attackers to execute malicious payloads from attacker-controlled shares or hidden directories.
Detects the ToddyCat APT group's technique of using PowerShell to connect to remote hosts via SMB admin shares (C$) and steal web browser credentials. This is associated with a variant of the TomBerBil tool and is particularly significant when observed originating from a domain controller.
Mythic C2 over SMB Detection
Cortex XDR
This rule detects potential Mythic C2 activity communicating over SMB. It identifies network traffic using the SMB protocol with a total upload size greater than 360 bytes, originating from and destined for private IP address ranges. The rule then groups these connections by agent hostname, local IP, remote IP, and process image name, flagging instances where three or more such connections occur within a 7-day timeframe, indicating potential beaconing behavior.
This rule detects Command and Control (C2) communication associated with the Mythic C2 framework utilizing Server Message Block (SMB) for peer-to-peer (P2P) beaconing. It specifically looks for SMB_COM_WRITE_ANDX commands with a data size greater than 360 bytes, containing a specific null byte pattern at offset 86, and a PCRE match for a GUID-like string, which are indicators of Mythic C2 SMB P2P beacon traffic.
This rule detects the use of common file transfer and remote access protocols (SSH, FTP, SMB, TELNET, FTPS, SMB.v3) communicating over non-standard ports. Adversaries often use non-standard ports to bypass firewall rules, evade detection, or obscure their command and control (C2) traffic. The rule specifically excludes the standard ports for these protocols to focus on anomalous behavior.
Detects a potential ToddyCat APT technique where a single source remotely accesses sensitive browser or DPAPI credential files on multiple hosts via SMB. This behavior is consistent with the group's TomBerBil PowerShell script used for widespread credential harvesting.
Detects a pattern of behavior associated with VanHelsing ransomware's lateral movement, where an executable is written to a device over SMB and then executed shortly after. This is indicative of remote code execution techniques like those using PsExec.
Page 15 of 25