Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
146 detections
Filters
Last updated
All Time
Detection languages
50
40
20
12
8
Contributors
33
26
24
12
11
Categories
64
63
62
32
25
Platforms
141
9
4
1
1
Products / Services
43
35
24
22
14
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
2
1
IDS Classtypes
7
5
IDS Protocols
6
3
Detects signs of Grixba malware activity, including process execution of Gt_net.exe from the Public/Music directory, associated WMI/WinRM remote network connections, and the creation of staging artifacts such as data.zip or ExportData.db.
Detects the spawning of common command-line or script execution shells (cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe) by the Windows Remote Management (WinRM) provider host (wsmprovhost.exe). This behavior is often indicative of remote code execution or lateral movement via WinRM.
This rule detects potential lateral movement attempts using Windows Remote Management (WinRM) by monitoring for specific WSMan SOAP protocol headers in HTTP traffic. It specifically looks for POST requests to the WSMan endpoint that contain suspicious keywords like 'winrs', 'MSRPC', or 's:Envelope', which are commonly associated with remote command execution via winrs or PSSession.
This rule detects potentially malicious activity leveraging the Windows Remote Management (WinRM) protocol over HTTP (ports 5985/5986). It specifically monitors for POST requests to the '/wsman' URI that contain the string 'powershell' in the request body, which is indicative of remote command execution via WinRM using PowerShell.
Detects potential lateral movement activity where PowerShell or the Windows Remote Management (WinRM) host process (wsmprovhost.exe) initiates network connections to multiple distinct destination IP addresses over the WinRM default ports (5985/5986). This behavior is characteristic of an adversary using legitimate remote administration tools to pivot or spread across a network.
This rule detects network connections over WinRM ports (5985, 5986) originating from potentially suspicious processes that are not standard Windows remote management binaries. It explicitly identifies activity where SharePoint-related processes initiate WinRM, which may indicate lateral movement patterns such as those seen in activity attributed to Storm-2603.
This rule detects network connections over WinRM ports (5985, 5986) originating from potentially suspicious processes that are not standard Windows remote management binaries. It explicitly identifies activity where SharePoint-related processes initiate WinRM, which may indicate lateral movement patterns such as those seen in activity attributed to Storm-2603.
Detects the execution of PowerShell commands used to initiate remote sessions (e.g., New-PSSession, Invoke-Command) targeting specific remote hosts, excluding localhost connections and common system processes. This behavior is often associated with lateral movement or remote administration activities.
Detects use of Impacket tooling (wmiexec, psexec, smbexec, atexec, secretsdump) for lateral movement and remote service execution.
Detects use of Impacket tooling (wmiexec, psexec, smbexec, atexec, secretsdump) for lateral movement and remote service execution, as observed in Operation Escaneo attributed to MexicanMafia targeting LatAm critical infrastructure. The rule identifies Impacket activity through process command lines, service installations, and network connections to SMB (port 445) and DCOM (port 135) from Python or Impacket-related executables.
Detects WMIC process creation against a remote node, which the ransomware can use as an alternative propagation method.
This rule detects suspicious process creation events where 'wsmprovhost.exe' (Windows Remote Management Provider Host) is the parent process. Wsmprovhost.exe is legitimately used for remote management via WinRM, but its child processes can indicate remote execution of commands or scripts, which is often abused by adversaries for lateral movement or execution.
Lateral Movement via VPN
Cortex XDR
This rule detects post-VPN activity indicative of discovery or lateral movement targeting directory services. It specifically looks for commands associated with LDAP, Kerberos, SMB, or WinRM activity to multiple internal systems, often seen after an initial VPN compromise. The rule focuses on processes like PowerShell, cmd, net, nltest, adfind, ldapsearch, wmic, and winrs executing commands related to network enumeration and directory service interaction.
Detects the use of WMIC to create processes on remote nodes, a technique observed with the Gentlemen ransomware for propagation. This rule specifically looks for 'wmic.exe' executions with command-line arguments indicating remote node targeting and process creation.
Detects WMI process creation on a remote node to run a batch file previously staged in ProgramData. This activity is often associated with adversaries using WMI for lateral movement and execution.
Detects WinRM remote management used for lateral movement
This rule detects post-VPN discovery or lateral movement activities by monitoring network connections initiated by specific command-line tools. It targets the use of utilities like PowerShell, cmd, net, nltest, adfind, ldapsearch, wmic, or winrs to interact with many internal systems, which could indicate an attacker performing reconnaissance or moving laterally within the network after gaining initial access, potentially via a compromised VPN.
Detects WinRM remote management used for lateral movement
This rule detects suspicious command-line activity indicative of Windows Management Instrumentation (WMI) being used for command execution. It specifically looks for `SecurityEvent` with `EventID 4688` (a process creation event) where the `CommandLine` contains keywords associated with WMI operations like `wmic process call create`, `wmic service`, `wmic os`, or `Get-WmiObject`, combined with selection or filtering keywords such as `select`, `where`, or `-ComputerName`. The rule triggers if three or more such events occur within an hour from the same computer and user.
This rule detects post-VPN discovery or lateral movement activities by monitoring network connections initiated by specific command-line tools. It targets the use of utilities like PowerShell, cmd, net, nltest, adfind, ldapsearch, wmic, or winrs to interact with many internal systems, which could indicate an attacker performing reconnaissance or moving laterally within the network after gaining initial access, potentially via a compromised VPN.
This rule detects suspicious command-line activity indicative of Windows Management Instrumentation (WMI) being used for command execution. It specifically looks for `SecurityEvent` with `EventID 4688` (a process creation event) where the `CommandLine` contains keywords associated with WMI operations like `wmic process call create`, `wmic service`, `wmic os`, or `Get-WmiObject`, combined with selection or filtering keywords such as `select`, `where`, or `-ComputerName`. The rule triggers if three or more such events occur within an hour from the same computer and user.
Page 4 of 7