Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
119 detections
Filters
Last updated
All Time
Detection languages
38
35
14
13
7
Contributors
18
14
13
13
12
Categories
50
41
25
20
17
Platforms
112
8
4
2
1
Products / Services
27
24
17
7
6
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
4
1
IDS Protocols
5
Surfaces Silverfort-detected incidents excluding ImpossibleTravel (high FP rate from VPN and mobile users, better covered by XSIAM Analytics UEBA)
Detects instances where the ESET Remote Administrator Agent (ERAAgent.exe) modifies registry keys related to Windows network security settings, such as LSA policies, NullSession pipes/shares, or server/workstation auto-sharing. These settings can be manipulated to weaken Windows security posture, potentially facilitating lateral movement or credential access.
Detects instances where the ESET Remote Administrator Agent (ERAAgent.exe) modifies registry keys related to Windows network security settings, such as LSA policies, NullSession pipes/shares, or server/workstation auto-sharing. These settings can be manipulated to weaken Windows security posture, potentially facilitating lateral movement or credential access.
Detects instances where the ESET Remote Administrator Agent (ERAAgent.exe) modifies registry keys related to Windows network security settings, such as LSA policies, NullSession pipes/shares, or server/workstation auto-sharing. These settings can be manipulated to weaken Windows security posture, potentially facilitating lateral movement or credential access.
Detects the NetworkShareScanner SMB/USB worm by known hash or by unsigned-executable propagation to remote shares/removable drives.
Detects ChonkyChicken's recon module by correlating TCP port scanning with ARP sweep or SMB share enumeration from the same host.
Detects high frequency inbound network connection attempts or accepted connections initiated by common file sharing processes (e.g., NearShare.exe, NearbySharing.exe, quickshare.exe, sharingd, airplayd). A high volume of inbound connection attempts may indicate brute force, discovery, or malicious scanning behavior using legitimate file sharing tools as a conduit.
Detects high frequency inbound network connection attempts or accepted connections initiated by common file sharing processes (e.g., NearShare.exe, NearbySharing.exe, quickshare.exe, sharingd, airplayd). A high volume of inbound connection attempts may indicate brute force, discovery, or malicious scanning behavior using legitimate file sharing tools as a conduit.
Detects reconnaissance activity associated with Akira ransomware, including PowerShell-based share enumeration (Invoke-ShareFinder, Get-NetShare), execution of unauthorized network scanning tools (e.g., SoftPerfect NetScan from non-standard paths), and the use of 'net view /domain' commands to identify accessible network resources.
Detects malicious network discovery and enumeration activities associated with Akira ransomware. This includes the execution of SoftPerfect Network Scanner (netscan.exe) for port/service scanning and the use of the PowerView Invoke-ShareFinder module for identifying accessible network shares, often observed in post-compromise intrusion phases.
Detects the creation of 'delete.me' files in sensitive Windows and SYSVOL directories. This behavior is a known artifact of the SoftPerfect Network Scanner, used during network enumeration to test for share writability.
This rule detects potential internal network reconnaissance activities by monitoring for either mass execution of network discovery commands (such as 'net view' or 'net share') targeting multiple unique hosts within a 5-minute window, or by monitoring for mass outbound network connections to port 445 (SMB) across multiple unique destination hosts within the same timeframe. This behavior is indicative of an attacker attempting to map available network shares or identify reachable systems for lateral movement.
Detects potential ransomware activity characterized by a high volume of file modifications (create, write, rename) involving common document/data extensions, combined with the execution of commands designed to inhibit system recovery (shadow copy deletion, BCD modifications) or perform network share enumeration within the same timeframe and on the same host.
Detects a suspicious sequence of adversary behaviors typically associated with pre-ransomware activity. The rule identifies high-volume SMB scanning (more than 20 unique IPs in 5 minutes) correlated with network share discovery (using tools like netscan.exe or PowerShell scripts such as Invoke-ShareFinder), and optionally links these actions to credential dumping events on the same host (LSASS dumping via comsvcs.dll or NTDS.dit exfiltration via wbadmin) within a 48-hour window.
Detects the execution of 'AdgNsy.exe', a known malicious masquerading process associated with the AdaptixC2 beacon, attempting to scan internal network infrastructure by initiating outbound connections to sensitive ports including SMB (445), RDP (3389), LDAP (389/636), and 9401. This behavior indicates internal reconnaissance for lateral movement.
Detects the use of the Windows net.exe or net1.exe utility to query network shares or session information, which is a common technique used by attackers for internal reconnaissance and network discovery.
Detects the use of the Windows net.exe or net1.exe utility to query network shares or session information, which is a common technique used by attackers for internal reconnaissance and network discovery.
This rule detects potential internal network reconnaissance activities by monitoring for either mass execution of network discovery commands (such as 'net view' or 'net share') targeting multiple unique hosts within a 5-minute window, or by monitoring for mass outbound network connections to port 445 (SMB) across multiple unique destination hosts within the same timeframe. This behavior is indicative of an attacker attempting to map available network shares or identify reachable systems for lateral movement.
Detects high frequency inbound network connection attempts or accepted connections initiated by common file sharing processes (e.g., NearShare.exe, NearbySharing.exe, quickshare.exe, sharingd, airplayd). A high volume of inbound connection attempts may indicate brute force, discovery, or malicious scanning behavior using legitimate file sharing tools as a conduit.
This rule detects the execution of PowerShell commands related to network share discovery (Invoke-ShareFinder, Get-NetShare) and the execution of the SoftPerfect Network Scanner (netscan.exe/netscan64.exe), which are techniques commonly used by adversaries for internal network reconnaissance.
Detects network share enumeration activity associated with Akira ransomware pre-deployment reconnaissance. The rule monitors for the execution of PowerShell PowerView cmdlets such as Invoke-ShareFinder, Find-DomainShare, and Get-NetShare, as well as the execution of the SoftPerfect Network Scanner (netscan.exe), including renamed instances staged in the ProgramData directory.
Page 2 of 6