Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,003 detections
Filters
Last updated
All Time
Detection languages
732
640
208
129
126
Contributors
374
315
226
187
119
Categories
565
420
368
284
263
Platforms
1,428
228
198
197
98
Products / Services
443
284
282
147
129
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
2,003
CVEs
10
9
9
8
8
IDS Classtypes
51
43
10
5
4
IDS Protocols
83
29
8
4
1
Detects potential lateral movement by monitoring user accounts performing interactive RDP logons (LogonType 10) to multiple distinct internal hosts within a 15-minute window. Additionally, identifies RDP logons occurring outside of standard business hours (before 6 AM or after 8 PM), a pattern often associated with human-operated ransomware activity.
KQL Query from file: grafana-mcp-server-mediated-probing-of-internal-ip-ranges-lateral-movement.kql
Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.
Detects the execution of the hacktool Rubeus using specific command line flags
Detects a child process spawned by 'winrshost.exe', which suggests remote command execution through Windows Remote Shell (WinRs) and may indicate potential lateral movement activity.
Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.
Adversaries may use to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.
This rule monitors firewall traffic logs to identify connections directed at managed internal endpoints originating from devices not tracked by the endpoint management system. It flags potential rogue or unauthorized devices performing multi-target reconnaissance or communication across the internal network.
FortiGate Allowed RDP Connection
Cortex XDR
Detects network traffic identified by FortiGate as Remote Desktop Protocol (RDP) that has been explicitly permitted (Accept action) by the firewall policy. This rule monitors for successful packet flow through the firewall, providing visibility into potential lateral movement paths via RDP.
Detects successful SSH authentication to a Linux system using public-key authentication by monitoring system logs for the 'Accepted publickey for' message. This rule identifies remote access attempts and serves as a foundation for monitoring lateral movement via SSH.
Detects a single Entra ID session (SessionId) being used from two different countries within one hour at a travel velocity no physical journey could achieve. This is a signature of a stolen session/refresh token being replayed by an actor from a different location than the legitimate user.
Slack Anomalous Activity
Cortex XDR
This rule detects anomalous activity reported by Slack's internal anomaly detection system. This includes events such as impossible travel, new device access, suspicious IP changes, and other behavioral anomalies that Slack identifies. The rule extracts relevant user and context information for further investigation.
Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.
Detects rundll32 execution where the DLL is located on a remote location (share)
Detects the execution of 'net use' commands targeting administrative shares (C$ or ADMIN$) on Windows systems. This behavior is frequently associated with lateral movement, where an adversary attempts to connect to remote file shares using administrative credentials to move files or execute malicious payloads.
This rule detects scenarios where a user's session originates from the 'Microsoft Authentication Broker' and another application (like 'OfficeHome' or 'One Outlook Web') within a short window (15 minutes), but from different source IP addresses. This indicates potential session hijacking or the use of stolen session cookies by an external actor.
Detects email notifications regarding the addition of a new Personal Access Token (PAT) to a GitHub account. This activity is often a precursor to unauthorized API access if an adversary has compromised a user's account.
Detects inbound Remote Desktop Protocol (RDP) connections targeting internal Windows devices from public IP addresses. This rule identifies potential unauthorized remote access, brute-force activity, or the exposure of RDP services to the public internet.
Detects anomalous NTLM authentication activity (LogonType 3) where a single account or source IP attempts to authenticate to 25 or more unique hosts within a 10-minute window. This behavioral pattern is frequently observed during credential spraying, pass-the-hash attacks, or unauthorized lateral movement attempts using NTLM.
Correlates a Microsoft 365 OAuth device-code authentication event with subsequent impact actions on the same identity (device registration/PRT setup, inbox rule creation, or PRT/sign-in activity after a password reset) within a 1-hour window. Severity escalates as more distinct impact phases co-occur on the same actor, consistent with ARToken/EvilTokens post-device-code-phishing persistence chains.
Detects the execution of psexesvc.exe, the service component of the PsExec tool, spawned from services.exe. This activity is indicative of lateral movement through the use of PsExec, which installs and executes the service to run commands remotely.
Page 4 of 96