Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
24 detections
Filters
Last updated
All Time
Detection languages
14
7
2
1
Contributors
7
7
6
2
1
Categories
7
7
5
4
3
Platforms
22
4
2
1
Products / Services
5
5
3
2
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
The following analytic detects the creation or deletion of Windows shares using the net.exe command. It leverages Endpoint Detection and Response (EDR) data to identify processes involving net.exe with actions related to share management. This activity is significant because it may indicate an attacker attempting to manipulate network shares for malicious purposes, such as data exfiltration, malware distribution, or establishing persistence. If confirmed malicious, this activity could lead to unauthorized access to sensitive information, service disruption, or malware introduction. Immediate investigation is required to determine the intent and mitigate potential threats.
Detects when the 'net.exe' or 'net1.exe' utility is used with the 'share' and '/delete' commands to remove a mounted network share. This activity can be performed by adversaries to clean up traces of their operations.
This rule detects attempts to disable the automatic creation of administrative shares (C$, ADMIN$) at system startup by modifying specific registry values. Adversaries might do this as a defense evasion technique to remove traces of their activity or to hinder forensic analysis, as administrative shares are often used for legitimate remote administration and can also be leveraged by attackers for lateral movement.
Page 2 of 2