Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
125 detections
Filters
Last updated
All Time
Detection languages
40
31
29
8
6
Contributors
38
28
17
17
7
Categories
34
26
26
18
16
Platforms
107
30
7
3
2
Products / Services
10,665
9,773
6,705
4,421
3,749
MITRE Techniques
57
48
31
28
23
CVEs
5
5
3
1
1
IDS Classtypes
13
10
2
2
1
IDS Protocols
25
3
This rule identifies potential network scanning or propagation activity by detecting a single host initiating SMB (TCP 445) connections to a high number (more than 20) of unique destination IP addresses within a given timeframe. This behavior is often indicative of internal reconnaissance, lateral movement, or worm-like propagation.
Detects unusual network connections over port 445 involving SMB named pipes commonly associated with lateral movement tools or P2P beaconing. The rule identifies communication through suspicious or generic pipe naming conventions that deviate from standard system process behavior (e.g., lsass, services, svchost, System).
Detects the SMB share discovery pattern associated with the DragonForce ransomware, where the system enumerates network shares (excluding ADMIN$) followed by unauthorized bulk write operations to these shares, indicating potential lateral movement and file encryption.
Detects the use of the Windows 'net' or 'net1' utility to connect to the hidden 'IPC$' inter-process communication share. This behavior is often associated with lateral movement, reconnaissance, or establishing authenticated sessions to remote systems for further malicious activity, such as remote command execution.
This rule detects potential NTLM relay activity directed toward WSUS servers by monitoring network connections. It specifically identifies Windows devices identified as 'wsus' that communicate over both SMB (TCP 445) and Microsoft SQL Server (TCP 1433) ports within a 10-minute window, suggesting an attacker attempting to relay authentication to the WSUS backend database.
This rule detects potential NTLM relay activity directed toward WSUS servers by monitoring network connections. It specifically identifies Windows devices identified as 'wsus' that communicate over both SMB (TCP 445) and Microsoft SQL Server (TCP 1433) ports within a 10-minute window, suggesting an attacker attempting to relay authentication to the WSUS backend database.
Detects ChonkyChicken's recon module by correlating TCP port scanning with ARP sweep or SMB share enumeration from the same host.
Detects the execution of 'net use' commands targeting administrative shares (C$ or ADMIN$) on Windows systems. This behavior is frequently associated with lateral movement, where an adversary attempts to connect to remote file shares using administrative credentials to move files or execute malicious payloads.
Detects network traffic attempting to exploit the SMBv1 vulnerability (CVE-2017-0144), commonly known as EternalBlue. The rule monitors for specific SMB Trans2 SESSION_SETUP packet structures associated with this remote code execution exploit.
Detects network exploitation attempts targeting the SMBv1 protocol using the EternalBlue vulnerability (MS17-010). This vulnerability was famously exploited by the WannaCry and NotPetya ransomware to propagate across networks.
This rule detects network traffic indicative of PsExec lateral movement, specifically identifying the authentication or access to the hidden 'ADMIN$' network share followed by the transfer or execution of the 'PSEXESVC' service binary, a hallmark of the PsExec tool.
Detects instances where a process running under the NT AUTHORITY\SYSTEM user context spawns a common execution utility (like cmd, powershell, or wscript) on a host that has recently engaged in network communication over port 445 (SMB). This behavior is highly indicative of lateral movement using SMB, such as service-based execution or remote command execution via tools like PsExec or WMI.
Detects instances where a process running under the NT AUTHORITY\SYSTEM user context spawns a common execution utility (like cmd, powershell, or wscript) on a host that has recently engaged in network communication over port 445 (SMB). This behavior is highly indicative of lateral movement using SMB, such as service-based execution or remote command execution via tools like PsExec or WMI.
Detects network exploitation attempts targeting the SMBv1 protocol using the EternalBlue vulnerability (MS17-010). This vulnerability was famously exploited by the WannaCry and NotPetya ransomware to propagate across networks.
Detects network traffic attempting to exploit the SMBv1 vulnerability (CVE-2017-0144), commonly known as EternalBlue. The rule monitors for specific SMB Trans2 SESSION_SETUP packet structures associated with this remote code execution exploit.
This rule detects suspicious SMB traffic targeting raw disk volumes (e.g., PhysicalDrive, C:) or sensitive Windows files such as NTDS.dit and SYSTEM hive files. This behavior is indicative of credential dumping attempts, often performed using tools like secretsdump.py or Invoke-NinjaCopy, which bypass standard file system access controls to exfiltrate critical system credentials.
This rule detects SMB traffic indicative of remote service creation over the SVCCTL named pipe, a pattern characteristic of tools like PsExec used for lateral movement and remote code execution.
Detects anomalous SMB NTLM authentication traffic indicative of relay attacks, where an attacker intercepts an authentication request and relays it to another SMB service.
Detects anomalous SMB NTLM authentication traffic indicative of relay attacks, where an attacker intercepts an authentication request and relays it to another SMB service.
This rule detects network traffic indicative of PsExec lateral movement, specifically identifying the authentication or access to the hidden 'ADMIN$' network share followed by the transfer or execution of the 'PSEXESVC' service binary, a hallmark of the PsExec tool.
This rule detects an unusually high volume of successful network connections over SMB (ports 135, 139, 445) originating from a single account within a one-hour window. This behavior can be indicative of lateral movement, reconnaissance, or data exfiltration activities using SMB/RPC.
Page 2 of 6