Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
146 detections
Filters
Last updated
All Time
Detection languages
50
40
20
12
8
Contributors
33
26
24
12
11
Categories
64
63
62
32
25
Platforms
141
9
4
1
1
Products / Services
43
35
24
22
14
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
2
1
IDS Classtypes
7
5
IDS Protocols
6
3
This rule detects attempts to establish a TCP connection to port 5985 on the home network, which is commonly used for WinRM (Windows Remote Management) over HTTP. The rule is configured to alert if three such connection attempts are made from the same source within a 60-second window, indicating potential lateral movement activity using WinRM.
This rule detects attempts to establish a WinRM HTTPS connection (port 5986) to a host on the home network. It specifically looks for TCP SYN packets (flags:S) and triggers if three such connection attempts are made from the same source within 60 seconds. This pattern can indicate lateral movement activity using WinRM over HTTPS.
Detects AdaptixC2 framework behaviors by correlating DNS over HTTPS (DoH) lookups to known providers (dns.google, dns.quad9) with subsequent Beacon Object File (BOF) activities. It specifically looks for the same process performing the DoH lookup and subsequently executing LSASS dumping commands, spawning sacrificial BOF processes, or initiating SMB/WinRM lateral movement.
Detects AdaptixC2 framework behaviors by correlating DNS over HTTPS (DoH) lookups to known providers (dns.google, dns.quad9) with subsequent Beacon Object File (BOF) activities. It specifically looks for the same process performing the DoH lookup and subsequently executing LSASS dumping commands, spawning sacrificial BOF processes, or initiating SMB/WinRM lateral movement.
Detects AdaptixC2 framework behaviors by correlating DNS over HTTPS (DoH) lookups to known providers (dns.google, dns.quad9) with subsequent Beacon Object File (BOF) activities. It specifically looks for the same process performing the DoH lookup and subsequently executing LSASS dumping commands, spawning sacrificial BOF processes, or initiating SMB/WinRM lateral movement.
Detects the execution of Winrs.exe where it is used to execute commands locally.
Commands executed this way are launched under Winrshost.exe and can represent proxy execution used for defense evasion or lateral movement.
Commands executed this way are launched under Winrshost.exe and can represent proxy execution used for defense evasion or lateral movement.
Detects tar.exe being spawned by processes commonly associated with initial access or lateral movement, such as web servers or remote management services. This activity is highly indicative of post-exploitation activity like data staging.
Detects remote PowerShell sections by monitoring for wsmprovhost (WinRM host process) as a parent or child process (sign of an active PowerShell remote session).
This query looks for indicators of CVE-2025-59287 exploitation, a critical WSUS deserialization flaw (CVSS 9.8) enabling unauthenticated remote code execution. Focuses on network, process, and file artifacts associated with exploitation.
Detects a child process spawned by 'winrshost.exe', which suggests remote command execution through Windows Remote Shell (WinRS) and may indicate potential lateral movement activity. The rule specifically filters out 'conhost.exe' as a common benign child process.
Detects the execution of Winrs.exe where it is used to execute commands locally. Commands executed this way are launched under Winrshost.exe and can represent proxy execution used for defense evasion or lateral movement.
This analytic identifies `Wsmprovhost.exe` spawning child processes that are known LOLBAS (Living Off the Land Binaries and Scripts) executables. This activity is significant because it may indicate an adversary using Windows Remote Management (WinRM) to execute code on remote endpoints, a common technique for lateral movement. If confirmed malicious, this could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment.
Detects the loading of WSMAN provider DLLs by processes other than the expected svchost.exe, or by svchost.exe with an unexpected original filename. This can indicate local or remote execution using Windows Remote Management (WinRM) or Windows Management Instrumentation (WMI) for lateral movement or execution, potentially by an attacker.
The analytic detects the execution of winrshost.exe initiating CMD or PowerShell processes. winrshost.exe is associated with Windows Remote Management (WinRM) and is typically used for remote execution. This behavior may indicate exploitation of remote management tools for unauthorized access or lateral movement within a compromised environment.
Detects scenarios where an attacker abuses the WinRS capacities for remote execution.
Detects scenarios where an attacker enumerates different remote WinRM listeners for lateral movement purposes.
Detects scenarios where an attacker enumerates different remote WinRM listeners for lateral movement purposes.
Detects the addition of a member to a sensitive Active Directory group related to VMware administration (e.g., 'vSphere Admins', 'ESX Admins') using net.exe executed via WinRM (wsmprovhost.exe). This behavior is a key TTP used by threat groups like UNC3944 to escalate privileges and gain control over the vSphere environment after an initial compromise.
KQL Query
KQL Query from file: Entra Admin Roles Query
KQL Query
Page 5 of 7