Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
128 detections
Filters
Last updated
All Time
Detection languages
65
36
9
9
4
Contributors
51
23
10
9
5
Categories
59
51
36
29
19
Platforms
118
12
11
4
2
Products / Services
35
30
24
23
12
MITRE Techniques
18,104
15,609
12,572
8,382
6,201
CVEs
14
4
2
1
IDS Classtypes
7
2
IDS Protocols
3
3
2
Detects the use of the spoolss named pipe over SMB. This can be used to trigger NTLM authentication from machines with the spooler service enabled, often as part of NTLM relay attacks or credential harvesting.
This rule detects attempts to coerce NTLM authentication on the Printer Spooler service, which can be used for privilege escalation. Specifically, it looks for `rundll32.exe` executing with command-line arguments related to `davclnt.dll,DavSetCookie` and keywords like `spoolss`, `srvsvc`, or `/print/pipe/`, indicating an NTLM relay attack against the print spooler service.
Page 7 of 7