Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
509 detections
Filters
Last updated
All Time
Detection languages
178
171
34
34
27
Contributors
111
85
80
49
32
Categories
182
138
137
114
63
Platforms
488
30
19
6
2
Products / Services
175
95
90
57
51
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
5
4
1
1
1
IDS Classtypes
23
4
2
1
1
IDS Protocols
27
6
Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation
Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module
Detects a copy command or a copy utility execution to or from an Admin share or remote
Detects known malicious service installations associated with Cobalt Strike beacons, often used for privilege escalation or lateral movement. The rule specifically looks for patterns in the ServiceFileName field of Windows Security Event ID 4697, such as the presence of 'ADMIN$' and '.exe', '%COMSPEC%', 'start', and 'powershell', or encoded PowerShell commands often used by Cobalt Strike.
Detects the execution of various compiled Windows binaries from the Impacket toolset. This rule identifies the tools based on their filenames or partial filenames, which could lead to false positives due to legitimate software having similar names or adversaries renaming the tools. Impacket is a collection of Python classes for working with network protocols, often used by adversaries for lateral movement, credential access, and execution.
This rule detects remote procedure calls (RPC) to modify the Windows Registry, which can be indicative of lateral movement or persistence mechanisms. Specifically, it monitors for RPC Firewall events with EventID 3 and an InterfaceUuid corresponding to the Remote Registry Protocol (338cd001-2244-31f1-aaaa-900038001003), focusing on specific operation numbers (OpNum) that represent various registry modification functions. This activity could be used by attackers to establish persistence, evade defenses, or execute code remotely.
Detects the creation of new Windows services that exhibit characteristics commonly associated with Cobalt Strike beacon activity, specifically focusing on suspicious ImagePath values. This includes services created with paths pointing to ADMIN$ shares, PowerShell commands for execution, or encoded PowerShell commands often used for downloading and executing payloads.
Detects Server Message Block (SMB) server connections to administrative shares (IPC$, ADMIN$, C$) that are established without signing or encryption enabled. This activity could indicate potential lateral movement by an adversary exploiting insecure SMB configurations.
Detects the creation or modification of Windows services in the registry that exhibit patterns commonly associated with Cobalt Strike beacons for persistence, privilege escalation, or lateral movement. Specifically, it looks for registry modifications to service control sets containing 'ADMIN$' and '.exe' or '%COMSPEC%', 'start', and 'powershell' in the service details, indicating a potential malicious service installation.
This rule detects attempts to write files to the local administrative share (ADMIN$) on a Windows system, specifically when the target is the local machine (127.0.0.0/8 IP range). Adversaries often use administrative shares for lateral movement, persistence, or to stage tools and data during post-exploitation activities. The detection logic looks for file events where the target filename contains both a local loopback IP address (e.g., \\127.0.0.1) and the administrative share name 'ADMIN$'.
Detects (failed) outbound connection attempts to internet-facing SMB servers. This could be a sign of potential exploitation attempts of CVE-2023-23397, which is a critical elevation of privilege vulnerability in Microsoft Outlook. The vulnerability allows an attacker to send a specially crafted email that, when opened, causes the victim's system to connect to an attacker-controlled SMB share and leak the victim's NTLM hash. This rule specifically looks for SMB client connectivity events (Event IDs 30803, 30804, 30806) where the destination IP address is not a private or loopback address, indicating an attempt to connect to an external SMB server.
Detects the execution of an executable with a 7-character lowercase alphanumeric name from the ADMIN$ share. This pattern is often associated with lateral movement techniques where tools like PsExec are used with randomly named service executables.
This rule detects attempts by non-system accounts to create or write to files on administrative shares (e.g., C$) via Server Message Block (SMB). This activity is often associated with lateral movement or persistence techniques where attackers drop tools or establish footholds on remote systems.
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement
Aversaries may use to interact with a remote network share using Server Message Block (SMB).
This technique is used by post-exploitation frameworks.
This technique is used by post-exploitation frameworks.
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement.
Detects SMB server connections to shares without signing or encryption enabled.
This could indicate potential lateral movement activity using unsecured SMB shares.
This could indicate potential lateral movement activity using unsecured SMB shares.
Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).
Detects the creation of or connection to named pipes commonly associated with PsExec activity, which is often used for lateral movement. This includes the default 'psexesvc' pipe and patterns used by impacket's psexec.py.
NetworkSignatureInspected just means the network sensor saw and matched a signature (it inspected the packet) — it doesn’t mean the flow was blocked. That’s the problem.
If your machines are negotiating SMB or NTLM with unknown remote IPs, you’ve got a real risk on your hands: data leakage, credential relay, or worm-style propagation. SMB to the Internet is almost never legitimate; if you don’t recognize the remote IP, treat it as suspicious.
The KQL query includes multiple conditions to detect not only default connections on legacy (139) or modern (445) SMB ports, but also cases where SMB is running over non-standard ports (attempts to evade simple port-based detection). It also extracts the SMB negotiation state so you can spot repeated or incomplete negotiation attempts (useful to detect scanning, failed auths, or relay attempts).
If your machines are negotiating SMB or NTLM with unknown remote IPs, you’ve got a real risk on your hands: data leakage, credential relay, or worm-style propagation. SMB to the Internet is almost never legitimate; if you don’t recognize the remote IP, treat it as suspicious.
The KQL query includes multiple conditions to detect not only default connections on legacy (139) or modern (445) SMB ports, but also cases where SMB is running over non-standard ports (attempts to evade simple port-based detection). It also extracts the SMB negotiation state so you can spot repeated or incomplete negotiation attempts (useful to detect scanning, failed auths, or relay attempts).
Page 16 of 25