Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11 detections
Filters
Last updated
All Time
Detection languages
7
4
Contributors
5
4
2
Categories
8
6
5
5
3
Platforms
6
4
Products / Services
5
4
1
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
IDS Classtypes
4
IDS Protocols
3
1
Detects the placement of potentially malicious executable or script files onto a network share followed by the execution of that specific file path from a different host within a short timeframe. This behavior is indicative of lateral movement using tainted shared content.
Detects the placement of potentially malicious executable or script files onto a network share followed by the execution of that specific file path from a different host within a short timeframe. This behavior is indicative of lateral movement using tainted shared content.
Detects the placement of potentially malicious executable or script files onto a network share followed by the execution of that specific file path from a different host within a short timeframe. This behavior is indicative of lateral movement using tainted shared content.
Detects the placement of potentially malicious executable or script files onto a network share followed by the execution of that specific file path from a different host within a short timeframe. This behavior is indicative of lateral movement using tainted shared content.
Detects the placement of potentially malicious executable or script files onto a network share followed by the execution of that specific file path from a different host within a short timeframe. This behavior is indicative of lateral movement using tainted shared content.
Identifies an unknown binary being access in some way (see AccessMask below) on the NETLOGON or SYSVOL share of a DC. Ransomware operators often stage ransomware executables here before deploying ransomware to an organization. While this query currently hits on ALL AccessMask values, you may want to tune out the less critical ones near the bottom of the list. Of course, Read & Execute is the most concerning, though you may want visibility into others depending on your environment. As always, test in your environment for known behavior and tune accordingly before operationalizing.
Identifies an unknown binary being access in some way (see AccessMask below) on the NETLOGON or SYSVOL share of a DC. Ransomware operators often stage ransomware executables here before deploying ransomware to an organization. While this query currently hits on ALL AccessMask values, you may want to tune out the less critical ones near the bottom of the list. Of course, Read & Execute is the most concerning, though you may want visibility into others depending on your environment. As always, test in your environment for known behavior and tune accordingly before operationalizing.
This rule detects when a file with the '.docm' extension is written to a network share via SMB. The presence of '.docm' suggests a macro-enabled Office document, which is often used in malicious campaigns. The rule specifically looks for the content '.docm' and a backslash character ('\') within the SMB traffic, indicating a file path or content related to a document.
This rule detects when an executable file (.exe) is dropped into a shared network folder. It specifically looks for SMB traffic containing both ".exe" and "\\share\\" in the content, indicating a potential attempt to distribute malicious executables or move them laterally within a network.
This rule detects the upload of a malicious executable file (identified by the 'MZ' header) to a SharePoint server via the REST API endpoint for folder manipulation. Specifically, it looks for HTTP POST requests to URIs containing '/_api/web/getfolderbyserverrelativeurl' with file data that starts with 'MZ'. This indicates an attempt to upload an executable file, potentially for lateral movement or further compromise within a SharePoint environment.
This rule detects the planting of script files, specifically PowerShell scripts (.ps1), on shared network drives. It looks for SMB traffic directed to a server on port 445 (SMB) that contains both the string ".ps1" (case-insensitive) and the string "\\share\\" (case-insensitive). This activity is indicative of an attacker staging scripts on a network share for potential lateral movement within a network.