Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
119 detections
Filters
Last updated
All Time
Detection languages
38
35
14
13
7
Contributors
18
14
13
13
12
Categories
50
41
25
20
17
Platforms
112
8
4
2
1
Products / Services
27
24
17
7
6
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
4
1
IDS Protocols
5
Detects scenarios where an attacker attempts to enumerate or to establish a connection to a network share.
This hunting rule searches for incoming ADWS connections on Domain Controllers from IP Addresses that cannot be linked to Microsoft Defender for Endpoint (MDE) onboarded devices. It aims to detect enumeration activities using ADWS from unmanaged or unknown devices, which might bypass typical monitoring tools.
This rule leverages Windows Security logs to detect potential lateral movement or staging activity involving a known artifact used by NetScan, a portable network scanning tool. Specifically, it monitors for attempts to write or delete files like `delete.me` across network shares.
Detects DEVMAN ransomware, a variant of DragonForce, based on unique strings related to its mutex, deterministic file renaming, and internal functionalities observed in analysis.
KQL Query from file: Threat Hunting - MDE Network Intrusion Discovery
Detects the execution of 'explorer.exe' to open the 'My Computer' folder, initiated by command-line interpreters like 'cmd.exe' or PowerShell. This behavior can be used by adversaries for discovery purposes, specifically to enumerate local drives and resources.
Detects the initial execution of "cmd.exe" which spawns "explorer.exe" with the appropriate command line arguments for opening the "My Computer" folder.
This analytic detects the execution of the Invoke-ShareFinder PowerShell cmdlet from PowerView. This detection leverages PowerShell Script Block Logging to identify instances where this specific command is executed. Monitoring this activity is crucial as it indicates an attempt to enumerate network file shares, which may contain sensitive information such as backups, scripts, and credentials. If confirmed malicious, this activity could enable an attacker to escalate privileges or move laterally within the network, potentially compromising additional systems and sensitive data.
Detects the initial execution of "cmd.exe" which spawns "explorer.exe" with the appropriate command line arguments for opening the "My Computer" folder.
Detects automated lateral movement by Turla group
Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
Use this query to find reconnaissance and beaconing activities after code injection occurs.
Reconnaissance commands are consistent with the current version of Qakbot and occur automatically to exfiltrate system information. This data, once exfiltrated, will be used to prioritize human operated actions.
Reconnaissance commands are consistent with the current version of Qakbot and occur automatically to exfiltrate system information. This data, once exfiltrated, will be used to prioritize human operated actions.
Net.EXE Execution
Sigma
Detects execution of "Net.EXE".
Query for processes that accessed more than 10 IP addresses over port 445 (SMB) - possibly scanning for network shares.
To read more about Network Share Discovery, see: https://attack.mitre.org/wiki/Technique/T1135.
Tags: #SMB, #NetworkScanning, #UniqueProcessId.
To read more about Network Share Discovery, see: https://attack.mitre.org/wiki/Technique/T1135.
Tags: #SMB, #NetworkScanning, #UniqueProcessId.
Net.EXE Execution
Sigma
Detects execution of "Net.EXE".
Detects automated lateral movement by Turla group
This query can be used to explore any instances where a terminated individual (i.e. one who has an impending termination date but has not left the company) downloads a large number of files from a non-Domain network address.
Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.
Detects potential Dridex acitvity via specific process patterns
Detects the use of Advanced Port Scanner.
Page 4 of 6