Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
509 detections
Filters
Last updated
All Time
Detection languages
178
171
34
34
27
Contributors
111
85
80
49
32
Categories
182
138
137
114
63
Platforms
488
30
19
6
2
Products / Services
175
95
90
57
51
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
5
4
1
1
1
IDS Classtypes
23
4
2
1
1
IDS Protocols
27
6
Detects Impacket-style hands-on-keyboard staging: a NeedyMantis bundle file dropped by cmd.exe/wmiprvse.exe/services.exe carrying the distinctive remote-execution fingerprint (ADMIN$ share reference, %COMSPEC% invocation, or 2>&1 output redirection used by wmiexec/smbexec/atexec), followed within 15 minutes by execution referencing the same bundle folder with the same fingerprint. Requiring the ADMIN$/%COMSPEC%/redirection fingerprint on both the copy and the execution -- rather than just matching on common process names like cmd.exe or svchost.exe -- removes the bulk of ordinary software installation and update activity that also uses cmd.exe to stage files.
This rule detects the execution of known lateral movement tools, including Impacket suite components and NetExec (formerly CrackMapExec), by monitoring process command lines. It specifically flags tools such as psexec.py, wmiexec.py, and secretsdump.py, which are frequently used for remote execution and credential dumping. The rule also joins these process events with network events targeting SMB port 445 to correlate tool usage with potential lateral movement activity.
This rule detects the execution of known lateral movement tools, including Impacket suite components and NetExec (formerly CrackMapExec), by monitoring process command lines. It specifically flags tools such as psexec.py, wmiexec.py, and secretsdump.py, which are frequently used for remote execution and credential dumping. The rule also joins these process events with network events targeting SMB port 445 to correlate tool usage with potential lateral movement activity.
This rule detects the execution of known lateral movement tools, including Impacket suite components and NetExec (formerly CrackMapExec), by monitoring process command lines. It specifically flags tools such as psexec.py, wmiexec.py, and secretsdump.py, which are frequently used for remote execution and credential dumping. The rule also joins these process events with network events targeting SMB port 445 to correlate tool usage with potential lateral movement activity.
Detects two distinct behaviors indicative of potential credential theft or lateral movement: DCSync-style Active Directory replication requests identified via Event ID 4662 with specific replication GUIDs, and high-volume SMB traffic originating from Domain Controllers or DC-adjacent hosts, which may indicate unauthorized data access or credential dumping activities.
Detects two distinct behaviors indicative of potential credential theft or lateral movement: DCSync-style Active Directory replication requests identified via Event ID 4662 with specific replication GUIDs, and high-volume SMB traffic originating from Domain Controllers or DC-adjacent hosts, which may indicate unauthorized data access or credential dumping activities.
Detects the creation of a remote service using 'sc.exe' where the executable was recently written to an administrative share (ADMIN$ or C$). This behavior often indicates lateral movement by threat actors deploying malicious binaries as services on remote systems.
Detects the use of net.exe or net1.exe to establish an IPC$ share connection. This is a common method for lateral movement and reconnaissance by attackers to verify administrative access or interact with remote systems via SMB. The rule specifically flags commands involving the IPC$ share, with logic to identify if a specific user was specified or if an anonymous session was attempted.
Detects the use of the Windows 'net.exe' utility to establish an IPC$ null session or an authenticated connection to the IPC$ share. These techniques are often used by attackers to perform remote service discovery, interact with remote shares, or facilitate lateral movement within a network.
Detects the creation of specific named pipes often associated with Cobalt Strike and similar C2 frameworks used for peer-to-peer (P2P) lateral movement. The detection looks for anomalous pipe names created by processes other than standard Windows system processes (svchost, services, lsass), which is a common indicator of beacon communication relaying.
Detects the creation of new system services using EventID 7045 where the ImagePath points to suspicious temporary directories, administrative shares (ADMIN$), or utilizes randomly generated service names. This pattern is commonly associated with PsExec-style lateral movement and ransomware staging.
This rule detects potential lateral movement activity involving the use of the 'net use' command to connect to remote IPC$ shares or administrative tools like 'Test-NetConnection' to probe for SMB and RPC ports (445/135). Such techniques are often used by threat actors like APT36 to verify network connectivity and establish authenticated sessions for lateral movement.
Detects DragonForce ransomware attempting to identify accessible SMB network shares by executing 'net view' commands. This activity is a precursor to encrypting files on reachable administrative shares (e.g., C$) while excluding system-specific shares like ADMIN$.
This rule identifies potential network scanning or propagation activity by detecting a single host initiating SMB (TCP 445) connections to a high number (more than 20) of unique destination IP addresses within a given timeframe. This behavior is often indicative of internal reconnaissance, lateral movement, or worm-like propagation.
Detects internal SMB traffic indicative of P2P beaconing using the IPC$ named pipe, which is often a sign of lateral movement or command-and-control communication between compromised hosts.
This rule detects command line patterns associated with common Impacket tools (wmiexec, psexec, smbexec) executed via Windows processes (cmd.exe, powershell.exe) or via network connections to ports 445 and 135 initiated by Python processes. These tools are frequently used by adversaries for lateral movement, remote service execution, and command execution on compromised systems.
Detects unusual network connections over port 445 involving SMB named pipes commonly associated with lateral movement tools or P2P beaconing. The rule identifies communication through suspicious or generic pipe naming conventions that deviate from standard system process behavior (e.g., lsass, services, svchost, System).
Detects the SMB share discovery pattern associated with the DragonForce ransomware, where the system enumerates network shares (excluding ADMIN$) followed by unauthorized bulk write operations to these shares, indicating potential lateral movement and file encryption.
Detects instances where a service account (indicated by a trailing $ in the username, excluding computer accounts) authenticates to three or more distinct hosts within a short time frame. This behavior is indicative of potential lateral movement or automated discovery activities using a compromised service credential.
This rule detects potential lateral movement by monitoring successful network logons using NTLM authentication across multiple distinct destination hosts within a short time window. It calculates the frequency of connections to unique hosts to identify anomalous, rapid traversal through a network by a single user account, excluding known system accounts.
Detects high volumes of file creations, modifications, or renames ending with a specific encrypted file extension (.df_win) occurring across multiple network (SMB) shares from a single host within a short timeframe. This behavior is indicative of ransomware activity where a compromised host attempts to encrypt files on accessible remote storage.
Page 4 of 25