Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
80 detections
Filters
Last updated
All Time
Detection languages
36
34
7
2
1
Contributors
36
34
7
2
1
Categories
18
18
11
7
7
Platforms
65
7
3
2
2
Products / Services
10,660
9,755
6,689
4,418
3,748
MITRE Techniques
33
25
24
23
17
CVEs
5
3
2
1
IDS Classtypes
2
IDS Protocols
2
Detects the creation of scheduled tasks on remote hosts by monitoring for the NetrJobAdd function call (opnum 0) against the ATSVC RPC interface (UUID: 1FF70682-0A51-30E8-076D-740BE8CEE98B). This interface is associated with the legacy Windows AT scheduler, which is frequently abused by offensive security tools like Impacket's atexec for remote command execution and lateral movement.
ShadowCoerce NTLM Coercion via FssAgent
Cortex XDR
Detects unauthorized attempts to coerce the File Server VSS Agent (FssAgent) into authenticating to an attacker-controlled host. This is achieved by invoking the IsPathSupported (opnum 8) or IsPathShadowCopied (opnum 9) functions on the FssAgent RPC interface, which can be leveraged to capture NTLM hashes.
Detects the use of the RpcRemoteFindFirstPrinterChangeNotificationEx function (opnum 58) on the Spoolss RPC interface. This function can be abused by attackers to coerce the Print Spooler service into authenticating against an attacker-controlled host via SMB, a technique commonly referred to as 'PrinterBug' or 'SpoolSample'. This authentication can subsequently be relayed to other services (such as AD CS or LDAP) to achieve privilege escalation.
This rule monitors for known suspicious RPC interface and function calls indicative of post-exploitation activities. It specifically targets RPC patterns used for lateral movement (e.g., PsExec, wmiexec, dcomexec), authentication coercion (e.g., PetitPotam, PrinterBug), and credential theft (e.g., DCSync, SAMR enumeration) by filtering on specific interface UUIDs and operation numbers.
Detects instances where the WMI Provider Host (wmiprvse.exe) spawns suspicious child processes such as cmd.exe, powershell.exe, or rundll32.exe, which are correlated with inbound network connections on ports 135 (RPC/DCOM) or 445 (SMB). This behavior is characteristic of lateral movement techniques used by tools like Impacket's wmiexec.
Remote Registry Access via Winreg RPC
Cortex XDR
Detects suspicious remote registry operations performed through the Winreg RPC interface. The rule monitors for interactions with sensitive registry hives (e.g., SAM, SECURITY, SYSTEM) or anomalous levels of remote registry activity originating from remote connections (SMB, TCP, Named Pipes). Such activity is often associated with credential dumping tools like Impacket's secretsdump or unauthorized remote configuration discovery.
PetitPotam NTLM Coercion via EFSRPC
Cortex XDR
This rule detects the use of EfsRpcOpenFileRaw (opnum 0) against the EFSRPC interface. This specific function is abused by the PetitPotam exploit to coerce a Windows machine, typically a domain controller, into authenticating to an attacker-controlled host via NTLM. This forced authentication is a precursor to NTLM relay attacks such as those targeting Active Directory Certificate Services (AD CS).
Remote Service Creation via SVCCTL RPC
Cortex XDR
Detects remote service manipulation, including service creation, starting, and deletion, using the SVCCTL RPC interface. This activity is a common method for lateral movement and remote code execution by tools like PsExec, smbexec, and CrackMapExec.
Detects anomalous DCOM RPC bind requests on port 135 targeting WMI-related interfaces, which is a common indicator of lateral movement using Windows Management Instrumentation (WMI) over DCOM.
Detects anomalous DCOM RPC bind requests on port 135 targeting WMI-related interfaces, which is a common indicator of lateral movement using Windows Management Instrumentation (WMI) over DCOM.
Detects remote RPC calls to modify the registry and possible execute code
Detects remote RPC calls to create or execute a scheduled task via the Advanced Telephony Service (ATSvc) interface. This activity can be indicative of lateral movement, privilege escalation, or persistence mechanisms used by adversaries.
Detects remote RPC calls to the ITaskSchedulerService interface, specifically focusing on operations that create or execute scheduled tasks. This behavior is commonly associated with lateral movement and persistence techniques. The rule leverages an RPC Firewall to monitor these specific RPC calls.
The following analytic detects the use of default or publicly known named pipes associated with Cobalt Strike. It leverages Sysmon EventID 17 and 18 to identify specific named pipes commonly used by Cobalt Strike's Artifact Kit and Malleable C2 Profiles. This activity is significant because Cobalt Strike is a popular tool for adversaries to conduct post-exploitation tasks, and identifying its named pipes can reveal potential malicious activity. If confirmed malicious, this could indicate an active Cobalt Strike beacon, leading to unauthorized access, data exfiltration, or further lateral movement within the network.
This rule detects remote procedure calls (RPC) to modify the Windows Registry, which can be indicative of lateral movement or persistence mechanisms. Specifically, it monitors for RPC Firewall events with EventID 3 and an InterfaceUuid corresponding to the Remote Registry Protocol (338cd001-2244-31f1-aaaa-900038001003), focusing on specific operation numbers (OpNum) that represent various registry modification functions. This activity could be used by attackers to establish persistence, evade defenses, or execute code remotely.
This rule detects remote procedure call (RPC) activity related to the creation or execution of scheduled tasks using the SASec interface. Specifically, it looks for Event ID 3 from the RPC Firewall log source, where the InterfaceUuid matches '378e52b0-c0a9-11cf-822d-00aa0051e40f' (which corresponds to the Task Scheduler service) and the OpNum is either 0 (SchRpcRegisterTask) or 1 (SchRpcRunTask). This indicates an attempt to remotely register or run a scheduled task, which can be a method for lateral movement, execution, or persistence by adversaries.
This analytic detects suspicious data transfer activities involving the use of the `split` syscall with the `-b` option, which specifies the size of each output file. This technique can be used by attackers to evade detection by breaking large files into smaller parts, bypassing size-based security controls, and facilitating covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall with a specified block size, this analytic helps identify potential data exfiltration attempts.
This analytic identifies the bulk creation of ransomware notes (e.g., .txt, .html, .hta files) on an infected machine. It leverages Sysmon EventCode 11 to detect multiple instances of these file types being created within a short time frame (10 seconds). A detection is triggered if 15 or more unique readme paths are observed. This activity is a strong indicator of an active ransomware attack, where the attacker is notifying the victim of the encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering critical files inaccessible and potentially causing significant operational disruption.
The following analytic detects suspicious attempts to find credentials stored in password stores, indicating a potential attacker's effort to access sensitive login information. Password stores are critical repositories that contain valuable credentials, and unauthorized access to them can lead to significant security breaches. By monitoring for unusual or unauthorized activities related to password store access, this analytic helps identify potential credential theft attempts, allowing security teams to respond promptly and prevent unauthorized access to critical systems and data.
The following analytic detects the creation of files in the Windows %startup% folder, a common persistence technique. It leverages the Endpoint.Filesystem data model to identify file creation events in this specific directory. This activity is significant because adversaries often use the startup folder to ensure their malicious code executes automatically upon system boot or user logon. If confirmed malicious, this could allow attackers to maintain persistence on the host, potentially leading to further system compromise and unauthorized access to sensitive information.
The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem data model to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity is significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
Page 1 of 4