Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
509 detections
Filters
Last updated
All Time
Detection languages
178
171
34
34
27
Contributors
111
85
80
49
32
Categories
182
138
137
114
63
Platforms
488
30
19
6
2
Products / Services
175
95
90
57
51
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
5
4
1
1
1
IDS Classtypes
23
4
2
1
1
IDS Protocols
27
6
Detects potential BlackLock ransomware activity where a process is launched with command-line arguments for network scanning and subsequently makes an SMB connection.
Detects potential PsExec command execution on remote systems by looking for common command-line flags used by the utility, specifically 'accepteula', user credentials (' -u ', ' -p '), and a remote path (' \\'). It filters out connections to localhost.
Detects suspicious usage of MpCmdRun.exe, the Microsoft Defender command-line utility, to potentially steal NTLM credentials. This rule specifically looks for MpCmdRun.exe being executed with parameters related to scanning or exclusion checking, combined with attempts to access remote UNC paths (\\). This behavior can indicate an adversary attempting to force NTLM authentication to a controlled server to capture hashes.
New KSMBD DoS (CVE-2025-38501) can exhaust SMB connections via half-open TCP handshakes — patch to Linux 6.1.15+ or rate-limit TCP/445 to mitigate.
This KQL query helps to hunt for connection attempts to port 445 across Linux endpoints in Defender XDR:
This KQL query helps to hunt for connection attempts to port 445 across Linux endpoints in Defender XDR:
Detects scenarios where an attacker exploit the PrintNightmare vulnerability by exposing a vulnerable shared printer. At any case, any new printer share creation should be carefully monitored.
Detects scenarios where an attacker execute a remote shell via the admin share.
Detects scenarios where an attacker execute PSexec on a remote host via SMB
Detects scenarios when a new file share is created.
Detects scenarios where an attacker attempts to enable insecure guest authentication in order to access a remote storage device (NAS) in order to perform some data exfiltration or lateral movement.
Detects scenarios where an attacker attempts to connect to the administrative SMB share.
Detects scenarios where an attacker (specially Blackcat) increase the number of oufstanding requests to distribute malware payloads.
Detects scenarios where an attacker attempts to remotely execute WMIexec via SMB admin share in order to escalate privileges.
Detects scenarios where an attacker installs and executes PSexec.
Detects scenarios where an attacker attempts to move laterally by mounting a network share using compromised user credentials.
Detects scenarios where an attacker attempts to enumerate or to establish a connection to a network share.
Detects scenarios where a user of a predefined set of group(s) logs on a target machine.
Detects scenarios where an attacker modifies network share permissions in order to facilitate lateral movement and avoid detection by creating new network shares
Detects the use of PsExec for lateral movement, a technique observed in use by Warlock ransomware affiliates. This rule identifies the creation or execution of the default PsExec service ('PSEXESVC.exe') on a target host.
This hunting rule searches for incoming ADWS connections on Domain Controllers from IP Addresses that cannot be linked to Microsoft Defender for Endpoint (MDE) onboarded devices. It aims to detect enumeration activities using ADWS from unmanaged or unknown devices, which might bypass typical monitoring tools.
Detects when the explorer.exe process makes a network connection over SMB to a remote host and subsequently creates an executable file. This behavior is indicative of CVE-2025-50154, where a specially crafted LNK file can cause explorer.exe to silently download a binary from a remote share without user interaction.
This detection identifies the use of common post-exploitation tools like PsExec, Impacket (specifically WMIExec), and Mimikatz. These tools are frequently used by threat actors for lateral movement and credential access after gaining initial access. The rule looks for specific process names and command-line arguments indicative of these tools.
Page 17 of 25