Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
509 detections
Filters
Last updated
All Time
Detection languages
178
171
34
34
27
Contributors
111
85
80
49
32
Categories
182
138
137
114
63
Platforms
488
30
19
6
2
Products / Services
175
95
90
57
51
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
5
4
1
1
1
IDS Classtypes
23
4
2
1
1
IDS Protocols
27
6
Detects network access to the 'protected_storage' service, specifically targeting the IPC$ share. This activity is often associated with attempts to extract DPAPI domain backup keys from Domain Controllers, a technique used for credential access and lateral movement.
Detects the use of the spoolss named pipe over SMB. This can be used to trigger NTLM authentication from machines with the spooler service enabled, often as part of NTLM relay attacks or credential harvesting.
This rule detects the first-time observation of remote named pipe connections, excluding a predefined list of common and legitimate named pipes. This behavior is often indicative of lateral movement or remote execution using named pipes, which attackers commonly leverage to move within a network or execute code on remote systems. The rule specifically looks for connections to '\\*\IPC$', a common administrative share used for interprocess communication over a network. By filtering out known legitimate named pipes, the rule aims to reduce false positives and highlight potentially malicious activity.
This rule detects the execution of PsExec or PAExec by monitoring network share access to the IPC$ share. Specifically, it looks for access to named pipes ending with '-stdin', '-stdout', or '-stderr', which are characteristic of PsExec/PAExec communication. The rule filters out instances where the service name starts with 'PSEXESVC', indicating the standard Sysinternals PsExec service, to reduce false positives for legitimate PsExec usage or when the attacker uses a different PsExec client.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario. This is identified by monitoring Windows Security Event ID 5145 for file creations ending with `\wbem\wbemcomn.dll` and filtering out legitimate system accounts (those ending with '$').
Detects the installation of a service by the smbexec.py tool, identified by a specific service name ('BTOBTO') and characteristic command-line arguments in the ImagePath, which typically involve executing a batch script and redirecting output.
Detects the execution of copy commands or utilities (robocopy, xcopy, cmd copy, PowerShell Copy-Item/Move-Item) targeting or originating from Windows Admin shares (e.g., C$) or the Sysvol folder. This activity can indicate lateral movement, data collection, or exfiltration by an adversary.
This rule detects the first-time use of a remote named pipe, excluding commonly known legitimate pipes. This can help identify lateral movement and remote execution attempts using named pipes, as adversaries often leverage these for inter-process communication across networked systems.
Detects remote service activity by monitoring access to the 'svcctl' named pipe via the IPC$ share. This activity is indicative of an attacker attempting to interact with services on a remote system, often as part of lateral movement or persistence efforts.
This rule detects the execution of PsExec or PAExec when the service name has been renamed from its default 'PSEXESVC'. It specifically looks for SMB file access events (smb_files) in Zeek logs where the path contains '\IPC$' and the name ends with '-stdin', '-stdout', or '-stderr', but filters out events where the name starts with 'PSEXESVC'. This helps to identify potentially malicious use of PsExec-like tools that attempt to evade detection by altering the service name, while reducing noise from legitimate PsExec usage or other PsExec clients.
This rule detects the execution of 'net.exe' or 'net1.exe' with the command-line argument '/TRANSPORT:QUIC'. This combination indicates an attempt to mount Windows SMB shares over QUIC, which might be an unusual or unexpected activity in many enterprise environments. Adversaries could leverage this for lateral movement or data access.
This rule detects instances where 'rundll32.exe' is executed without any command-line parameters. This behavior has been observed in the context of Metasploit's windows/smb/psexec exploit module, where rundll32.exe is used to proxy execution of malicious code. Legitimate uses of rundll32.exe typically involve specific DLL and function arguments.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network, which is a known technique for WMI DLL Hijacking. This specific scenario involves the `System` process, indicating a potential remote write operation followed by the system attempting to load the malicious DLL.
Detects the creation of a named pipe with the default name used by RemCom, a legitimate remote administration tool that can be abused by attackers for lateral movement and execution.
Detects suspicious output redirection to the local administrative share (ADMIN$). This technique is often used by malicious scripts or hack tools to stage or exfiltrate data by writing it to a location accessible via the network, specifically targeting the ADMIN$ share on localhost or 127.0.0.1.
Detects the creation of a named pipe with the default name '\csexecsvc', which is commonly used by CSExec for remote command execution. This activity is indicative of potential lateral movement or execution of unauthorized code.
This rule detects the use of 'net.exe' or 'net1.exe' with the 'use' command to mount an administrative share (e.g., C$, ADMIN$) on a Windows system. This activity is often associated with lateral movement by adversaries.
This rule detects the execution of 'net.exe' or 'net1.exe' with a password provided directly in the command line. This is a security risk as it exposes credentials and can be used for lateral movement, persistence, or privilege escalation. The rule specifically looks for the 'use' keyword, a colon followed by an asterisk and a backslash (indicating a password field), and '/USER:* *' to identify password usage in the command line arguments.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario. This specific rule focuses on `wmiprvse.exe` loading the hijacked `wbemcomn.dll`.
This rule detects the use of the PowerShell cmdlet `New-PSDrive` to map a new drive to a remote Windows administrative share (e.g., C$, ADMIN$). This activity is often associated with lateral movement by adversaries who use valid credentials to interact with remote systems over Server Message Block (SMB). The rule specifically looks for the `New-PSDrive` cmdlet, the `-psprovider filesystem` argument, the `-root` argument, and the presence of a UNC path (`\\`) ending with a dollar sign (`$`), which is characteristic of administrative shares.
Detects when a network share is mounted using the "net.exe" or "net1.exe" utility with the 'use' command, indicating potential lateral movement or data access activity.
Page 23 of 25