Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
136 detections
Filters
Last updated
All Time
Detection languages
75
33
12
8
3
Contributors
26
24
18
10
9
Categories
58
45
36
29
24
Platforms
117
9
9
5
4
Products / Services
40
29
19
8
6
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
5
3
IDS Protocols
3
3
2
Detects the use of command-line tools such as 'scp', 'rsync', and 'sftp' that are commonly used to copy files to or from remote systems. This activity can be indicative of an adversary transferring tools into an environment (Ingress Tool Transfer) or moving files laterally within a compromised network (Lateral Tool Transfer). The rule specifically looks for the presence of these tool names followed by a space and then a colon or an '@' symbol, which are characteristic of remote file operations.
This rule detects the execution of PsExec via the command line on Windows systems. PsExec is a legitimate Microsoft tool that allows administrators to execute processes on remote systems, but it is also frequently abused by adversaries for lateral movement and remote execution within a compromised network.
Command-line execution of the PsExec tool on Windows
This rule detects suspicious connections to the ADFS database via named pipes. It specifically looks for processes connecting to the `\\MICROSOFT##WID\tsql\query` named pipe on ADFS servers, excluding legitimate ADFS-related processes such as `Microsoft.Identity.Health.Adfs.PshSurrogate.exe`, `Microsoft.IdentityServer.ServiceHost.exe`, `AzureADConnect.exe`, `Microsoft.Tri.Sensor.exe`, `wsmprovhost.exe`, `mmc.exe`, `sqlservr.exe`, and `sqlwriter.exe`. Such connections from unauthorized processes may indicate an attempt to access ADFS for malicious purposes.
Detects the installation of services that are characteristic of Metasploit's SMB PsExec module (exploit/windows/smb/psexec) and Impacket's psexec.py. The rule specifically looks for Windows Security Event ID 4697 (A service was installed in the system) where the ServiceFileName matches a pattern of '%systemroot%\<8_random_chars>.exe' and the ServiceName matches a pattern of 4, 8, or 16 alphabetic characters, while excluding the known legitimate 'PSEXESVC' service.
This rule detects the use of PowerShell to mount Server Message Block (SMB) shares over the QUIC transport protocol. This activity, while legitimate, can be unusual in some enterprise environments and may indicate an adversary attempting to establish lateral movement or data transfer channels using a less common protocol.
This rule detects the execution of 'net.exe' or 'net1.exe' with the command-line argument '/TRANSPORT:QUIC'. This combination indicates an attempt to mount Windows SMB shares over QUIC, which might be an unusual or unexpected activity in many enterprise environments. Adversaries could leverage this for lateral movement or data access.
Detects the creation of the PSEXEC key file, which is generated whenever a PsExec command is executed. This file is written to the file system and recorded in the USN Journal on the target system, serving as an indicator of PsExec activity.
This rule detects instances where 'rundll32.exe' is executed without any command-line parameters. This behavior has been observed in the context of Metasploit's windows/smb/psexec exploit module, where rundll32.exe is used to proxy execution of malicious code. Legitimate uses of rundll32.exe typically involve specific DLL and function arguments.
Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system
Page 7 of 7