Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
128 detections
Filters
Last updated
All Time
Detection languages
65
36
9
9
4
Contributors
51
23
10
9
5
Categories
59
51
36
29
19
Platforms
118
12
11
4
2
Products / Services
35
30
24
23
12
MITRE Techniques
18,104
15,609
12,572
8,382
6,201
CVEs
14
4
2
1
IDS Classtypes
7
2
IDS Protocols
3
3
2
KQL Query from file: Hunting Rogue Endpoints via SMB Detection
KQL Query
KQL Query from file: NTLMv2 Hash Leak via COM Detection
KQL Query from file: KQLWiz PDF NTLM Leak Detector
KQL Query
KQL Query
KQL Query from file: CVE-2025-24054 NTLM Exploit in the Wild Detection
KQL Query from file: CVE-2024-38200 NTLM Exposure Detection
Detects different hacktools used for relay attacks on Windows for privilege escalation
Detects different hacktools used for relay attacks on Windows for privilege escalation
Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives)
Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like
Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows
This query identifies files that are copied to a device over SMB, then executed within a
specified threshold. Default is 5 seconds, but is configurable by tweaking the value for
ToleranceInSeconds.
specified threshold. Default is 5 seconds, but is configurable by tweaking the value for
ToleranceInSeconds.
Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service
Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service
Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives)
Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode
First query digs in print spooler drivers folder for any file creations,
MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Unsigned files
or ones that don't have any relations to printers that you are using are
suspicious.
Second query that can be used for finding client machines that
could be operating print servers or file servers is also included here.
As additional mitigation for the exploit you might want to block the
incoming traffic to the SMB or EPMAP Ports (445) if you need to keep the
spooler service running to print from clients.
MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Unsigned files
or ones that don't have any relations to printers that you are using are
suspicious.
Second query that can be used for finding client machines that
could be operating print servers or file servers is also included here.
As additional mitigation for the exploit you might want to block the
incoming traffic to the SMB or EPMAP Ports (445) if you need to keep the
spooler service running to print from clients.
This rule detects authentication attempts (both successful and failed) originating from a host with a 16-character alphanumeric workstation name, specifically looking for NTLM authentication. This pattern is characteristic of Metasploit's SMB modules, which often generate random 16-character workstation names during authentication attempts. The rule aims to identify potential lateral movement or reconnaissance activities using Metasploit against Windows systems.
Detects the use of the 'spoolss' named pipe over SMB, which can be leveraged to trigger NTLM authentication from a target machine with the print spooler service enabled. This technique is often used in NTLM relay attacks or other forms of printer spooler abuse to gain unauthorized access or escalate privileges.
Page 6 of 7