Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
119 detections
Filters
Last updated
All Time
Detection languages
38
35
14
13
7
Contributors
18
14
13
13
12
Categories
50
41
25
20
17
Platforms
112
8
4
2
1
Products / Services
27
24
17
7
6
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
4
1
IDS Protocols
5
This rule detects suspicious activity related to high-volume Server Message Block (SMB) share enumeration and the execution of a specific Python script named 'backup_dfs.py'. It combines three detection logics: identifying processes executing 'backup_dfs.py', detecting an unusual number of SMB network connections to common administrative shares (SYSVOL, NETLOGON, DFS), and flagging high-volume SMB-related identity directory events targeting SYSVOL or NETLOGON. This behavior could indicate an adversary performing discovery of network shares, collecting data, or preparing for data exfiltration.
Detects the use of 'net.exe' or 'net1.exe' with arguments 'view', 'share', or 'use' that appear in rapid succession or are initiated by potentially suspicious parent processes. This behavior is often associated with network enumeration and reconnaissance activities.
Detects the use of 'net.exe' or 'net1.exe' with arguments 'view', 'share', or 'use' that appear in rapid succession or are initiated by potentially suspicious parent processes. This behavior is often associated with network enumeration and reconnaissance activities.
This rule detects suspicious activity related to high-volume Server Message Block (SMB) share enumeration and the execution of a specific Python script named 'backup_dfs.py'. It combines three detection logics: identifying processes executing 'backup_dfs.py', detecting an unusual number of SMB network connections to common administrative shares (SYSVOL, NETLOGON, DFS), and flagging high-volume SMB-related identity directory events targeting SYSVOL or NETLOGON. This behavior could indicate an adversary performing discovery of network shares, collecting data, or preparing for data exfiltration.
This rule detects various reconnaissance techniques commonly used to identify network resources, including the execution of SoftPerfect Network Scanner (or renamed binaries), the creation of 'delete.me' files used by SoftPerfect to probe share permissions, the usage of the 'Invoke-ShareFinder' PowerShell script, and the enumeration of network shares using 'net.exe' initiated from PowerShell.
Detects attempts to discover network shares and remote systems using 'net share', 'net view' commands, or by accessing UNC paths with extended path prefixes, which can be indicative of lateral movement or reconnaissance activities.
Detects network share enumeration commands executed inside a remote desktop session, matching post-access discovery of mapped corporate storage. This rule specifically looks for commands like 'net use', 'net view', PowerShell cmdlets such as 'Get-SmbShare', 'Get-PSDrive', 'Get-SmbMapping', WMI queries for 'Win32_LogicalDisk', or UNC path references ('\\') executed via 'cmd.exe', 'powershell.exe', 'pwsh.exe', 'net.exe', or 'net1.exe' within a remote session.
Detects discovery of cluster storage, mapped drives, and remote volumes using common Windows utilities and PowerShell commands, which is a behavior observed in the Gentlemen ransomware before selecting encryption targets.
Correlates Windows 365 or Citrix client execution with network share discovery commands by the same account on the same device within thirty minutes. This rule detects potential post-compromise activity where an attacker might be using a VDI session to enumerate network shares.
Detects the execution of 'netsh.exe', 'sc.exe', or 'powershell.exe' with command-line arguments indicative of enabling network discovery, file and printer sharing, or modifying firewall rules to allow inbound connections. This behavior is associated with the Gentlemen ransomware for propagation.
This rule detects an unusually high volume of network share access attempts from a single IP address and account within a short time frame (5 minutes). This could indicate an adversary attempting to discover or access network shares, potentially for data exfiltration or lateral movement.
This rule detects attempts to enumerate SMB network shares. It triggers when TCP traffic is directed to port 445 (SMB) on the home network, contains the SMB protocol signature, and specifically includes the string 'NetShareEnum' (case-insensitive). A threshold of 5 occurrences within 60 seconds from the same source IP is applied to reduce false positives.
Detects enumeration of network shares via net view command
This rule detects an unusually high volume of network share access attempts from a single IP address and account within a short time frame (5 minutes). This could indicate an adversary attempting to discover or access network shares, potentially for data exfiltration or lateral movement.
This query identifies potential post-exploitation behavior on Linux systems by monitoring for clusters of discovery and enumeration commands. Instead of alerting on single, potentially benign commands, it utilizes a behavioral scoring engine that categorizes activities such as credential hunting, privilege escalation, and network scanning.
By implementing extensive allowlists for common administrative tools (e.g., Ansible, Zabbix, Monitoring Agents) and requiring a minimum threshold of unique activity categories, the query effectively filters out "noise." It calculates a dynamic Risk Score and assigns a Severity level based on the criticality of the commands and the speed of execution (Burst Detection), making it a highly reliable tool for SOC analysts to detect active hands-on-keyboard attacks.
By implementing extensive allowlists for common administrative tools (e.g., Ansible, Zabbix, Monitoring Agents) and requiring a minimum threshold of unique activity categories, the query effectively filters out "noise." It calculates a dynamic Risk Score and assigns a Severity level based on the criticality of the commands and the speed of execution (Burst Detection), making it a highly reliable tool for SOC analysts to detect active hands-on-keyboard attacks.
verifica se um share de rede foi criado nos ultimos x dias
Detects access to hidden or decoy network shares that are not used by legitimate processes. This activity is indicative of network reconnaissance and lateral movement attempts. Walkthrough of Canary Shares can be found here: https://github.com/fluffybunnies-h4x/CyberDeception/blob/main/README.md#canary-shares
Detects the initial execution of "cmd.exe" which spawns "explorer.exe" with the appropriate command line arguments for opening the "My Computer" folder.
Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.
Detects the use of Advanced Port Scanner.
Detects scenarios where an attacker enumerate different host via named pipes with SharpHound for discovery purposes.
Page 3 of 6