Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
128 detections
Filters
Last updated
All Time
Detection languages
65
36
9
9
4
Contributors
51
23
10
9
5
Categories
59
51
36
29
19
Platforms
118
12
11
4
2
Products / Services
35
30
24
23
12
MITRE Techniques
18,104
15,609
12,572
8,382
6,201
CVEs
14
4
2
1
IDS Classtypes
7
2
IDS Protocols
3
3
2
This rule detects NBT-NS (NetBIOS Name Service) poisoning responses. NBT-NS poisoning is a technique used by attackers to intercept network traffic by responding to NetBIOS name queries with their own IP address, effectively redirecting traffic. The rule specifically looks for UDP traffic on port 137 (NetBIOS Name Service) destined for the home network, containing the byte sequence '|85 00|' at a depth of 4 bytes, which is indicative of a NetBIOS Name Service response. A threshold of 5 such responses within 10 seconds from the same source IP triggers the alert, aiming to reduce false positives from legitimate, but infrequent, NBT-NS responses.
This rule detects a Link-Local Multicast Name Resolution (LLMNR) poisoning response from a rogue host. It specifically looks for UDP traffic on port 5355 (LLMNR) where the content contains the byte sequence '|80 00|' at a depth of 4 bytes. A threshold is applied to trigger an alert if 5 such responses are observed from the same source IP within 10 seconds, indicating potential malicious activity like credential harvesting.
Detects SMB NTLM relay attacks used for credential capture and lateral movement
This rule detects potential SMB Relay attacks attempting to capture NTLM hashes. It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, where the flow is established and contains both "NTLMSSP" and "NTLMSSP_AUTH" content. A threshold of 3 occurrences within 30 seconds from the same source IP is set to reduce false positives.
Detects the presence of 'search:' or 'search-ms:' URI schemes embedded in inbound emails. These schemes can be abused to force outbound NTLM authentication and leak Net-NTLMv2 hashes via a single link click.
Detects command line execution of 'search:' or 'search-ms:' URI handlers utilizing the 'crumb=location:' parameter pointing to a remote UNC path, which forces outbound NTLM authentication. This technique can be used by adversaries to capture NTLM hashes.
This rule detects suspicious NTLM network or remote interactive logon activity. It specifically looks for multiple distinct accounts logging in from the same device and remote IP address within a one-hour window, using NTLM authentication via NtLmSsp or Seclogon processes. This pattern can indicate credential stuffing, NTLM relay attacks, or other forms of credential misuse.
This rule detects suspicious NTLM network or remote interactive logon activity. It specifically looks for multiple distinct accounts logging in from the same device and remote IP address within a one-hour window, using NTLM authentication via NtLmSsp or Seclogon processes. This pattern can indicate credential stuffing, NTLM relay attacks, or other forms of credential misuse.
Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows
Detects Notepad.exe initiating outbound network connections, specifically over SMB (port 445) or to public IP addresses over HTTP/S. This behavior is highly anomalous and can indicate an attempt to exploit CVE-2026-20841 to trigger an NTLM relay attack for credential harvesting or to download a remote payload.
Detects a pattern indicative of an NTLM relay attack following an authentication coercion spray. The rule first identifies a single source IP generating a high volume of failed NTLM logon attempts across multiple critical servers in a short time. It then looks for a subsequent successful NTLM logon from that same source IP to a high-value target (like a Certificate Authority) using a machine account. This sequence is a strong indicator that an attacker coerced credentials and is now relaying them to escalate privileges.
Detects Remote Procedure Call (RPC) attempts targeting critical assets, such as Domain Controllers, where the call includes a UNC path pointing to an external IP address. This is a strong indicator of an authentication coercion attack (e.g., PetitPotam, DFSCoerce) where an attacker is attempting to force the critical asset to authenticate to a listener they control to capture credentials.
Detects Remote Procedure Call (RPC) authentication coercion attempts where a machine is forced to authenticate to an external IP address. Attackers use this technique to capture credentials by tricking a server into connecting to a listener they control. This rule identifies known vulnerable RPC interfaces and functions (including rare ones like MS-EVEN/ElfrOpenBELW) being used with a UNC path parameter that points to a public IP address.
Detects Remote Procedure Call (RPC) authentication coercion attempts where a machine is forced to authenticate to an external IP address. Attackers use this technique to capture credentials by tricking a server into connecting to a listener they control. This rule identifies known vulnerable RPC interfaces and functions (including rare ones like MS-EVEN/ElfrOpenBELW) being used with a UNC path parameter that points to a public IP address.
Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack refereed to as PetitPotam.
The usage of this RPC function should be rare if ever used at all.
Thus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation to determine if it is legitimate.
View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'
The usage of this RPC function should be rare if ever used at all.
Thus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation to determine if it is legitimate.
View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'
Detects usage of the Windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack referred to as PetitPotam. The usage of this RPC function should be rare if ever used at all. Thus, any usage of this function is uncommon enough that it should warrant further investigation to determine if it is legitimate. View surrounding logs (within a few minutes before and after) from the Source IP to determine if it is legitimate. Logs from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc.
This rule detects the execution of various hack tools and scripts commonly used for SMB relay attacks and privilege escalation on Windows systems. It specifically looks for process creations or command-line arguments associated with tools like PetitPotam, RottenPotato, HotPotato, JuicyPotato, Responder, ntlmrelayx, and smbrelayx, as well as PowerShell scripts like Invoke-Tater and Invoke-PetitPotam. The rule aims to identify attempts to exploit NTLM relay vulnerabilities to gain elevated privileges or access credentials.
Detects the execution of various compiled Windows binaries from the Impacket toolset. This rule identifies the tools based on their filenames or partial filenames, which could lead to false positives due to legitimate software having similar names or adversaries renaming the tools. Impacket is a collection of Python classes for working with network protocols, often used by adversaries for lateral movement, credential access, and execution.
This rule detects logon events (EventID 4624) with LogonType 3 (network logon) where the TargetUserName is 'ANONYMOUS LOGON' and the WorkstationName is '-' (indicating a local system or unknown workstation). Additionally, the source IP address must be a loopback address ('127.0.0.1' or '::1'). This specific combination of characteristics is indicative of a RottenPotato-like attack pattern, which exploits local NTLM relay vulnerabilities to escalate privileges.
Detects the loading of the WinDivert driver, which is a powerful user-mode package for Windows capable of capturing, sniffing, modifying, blocking, and re-injecting network traffic. This driver can be used by adversaries for network sniffing, credential access, and defense evasion techniques.
Detects command line parameters used by ADCSPwn, a tool designed to escalate privileges in an Active Directory network. This tool achieves privilege escalation by coercing authentication from machine accounts and relaying it to the certificate service.
Page 4 of 7