Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
509 detections
Filters
Last updated
All Time
Detection languages
178
171
34
34
27
Contributors
111
85
80
49
32
Categories
182
138
137
114
63
Platforms
488
30
19
6
2
Products / Services
175
95
90
57
51
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
5
4
1
1
1
IDS Classtypes
23
4
2
1
1
IDS Protocols
27
6
This detection identifies outbound NTLM authentication attempts to remote SMB servers with suspicious characteristics consistent with the use of impacket-smbserver, a tool commonly used by adversaries for lateral movement and data exfiltration. The detection looks for RemotePort 445 traffic where:
- The server version is the anomalous string 255.255 65535 255
- Server identity fields (DNS and NetBIOS names) are exactly 8 characters long, which is typical for randomly generated names by impacket-smbserver
This pattern strongly indicates impersonation or malicious SMB hosting by an attacker within the network.
- The server version is the anomalous string 255.255 65535 255
- Server identity fields (DNS and NetBIOS names) are exactly 8 characters long, which is typical for randomly generated names by impacket-smbserver
This pattern strongly indicates impersonation or malicious SMB hosting by an attacker within the network.
Detects DEVMAN ransomware, a variant of DragonForce, based on unique strings related to its mutex, deterministic file renaming, and internal functionalities observed in analysis.
Detects activity related to exploitation of Ivanti Connect Secure vulnerabilities (CVE-2025-0282, CVE-2025-22457) using MDifyLoader, Cobalt Strike, vshell, DslogdRAT, and Fscan. Includes file, process, and network-based IOCs from JPCERT report.
SMBExec was Used
S1QL
Detects potential attempts to access administrative shares using cmd.exe or powershell.exe, which could indicate lateral movement or unauthorized access attempts.
KQL Query from file: DEVMAN ransomware detection
Detection of potentially malicious activities on Windows systems related to Sysmon events, focusing on executable files, registry changes, and network connections.
KQL Query
KQL Query from file: Endpoint SMB exposed on Public Internet
KQL Query from file: Hunting Rogue Endpoints via SMB Detection
KQL Query
KQL Query from file: KQLWiz PDF NTLM Leak Detector
KQL Query from file: psexecsvc.py detection
KQL Query
KQL Query from file: CVE-2024-38200 NTLM Exposure Detection
KQL Query from file: CVE-2024-43452 PoC Detection
Alerts on Metasploit host's authentications on the domain.
Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class over the network
Detects automated lateral movement by Turla group
Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation
Detects access to ADMIN$ network share
Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).
Page 18 of 25