Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
98 detections
Filters
Last updated
All Time
Detection languages
52
16
12
8
6
Contributors
24
17
12
10
9
Categories
70
68
13
13
12
Platforms
97
10
3
Products / Services
31
30
21
12
10
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
CVEs
3
Detects the registration of a new scheduled task occurring within a network logon session (LogonType 3). This behavior is characteristic of lateral movement techniques where attackers use remote service execution tools (such as Impacket's atexec or PRTremote) to register and execute tasks on a remote host via SMB/RPC. The rule correlates Windows Security Event 4698 (Task creation) with network logon events and validates the action using Task Scheduler operational logs.
Detects the registration of a new scheduled task occurring within a network logon session (LogonType 3). This behavior is characteristic of lateral movement techniques where attackers use remote service execution tools (such as Impacket's atexec or PRTremote) to register and execute tasks on a remote host via SMB/RPC. The rule correlates Windows Security Event 4698 (Task creation) with network logon events and validates the action using Task Scheduler operational logs.
This rule detects the execution of common Python-based network relay and exploitation tools such as Impacket's ntlmrelayx, smbserver.py, and PetitPotam. These tools are frequently utilized by adversaries to conduct NTLM relay attacks, perform remote service execution, or facilitate credential dumping.
Detects the execution of known Kerberoasting tools such as Rubeus and Impacket (GetST, GetTGT, asktgs) or command-line arguments indicative of Kerberoasting, specifically targeting RC4/ETYPE-23 ticket requests that are often used to crack service account passwords offline.
Detects the execution of known Impacket framework tools (such as secretsdump, wmiexec, smbexec, atexec, GetUserSPNs, or ntlmrelayx) which are commonly used for credential dumping, remote service execution, and lateral movement.
This rule detects the execution of known offensive security and post-exploitation toolsets (such as Impacket, Metasploit, CrackMapExec, or NetExec) when initiated from virtualization processes like QEMU. This pattern is indicative of an adversary executing malicious payloads from within a virtual machine or using virtualization software as a proxy for malicious activity on the host.
Detects the execution of known Impacket relay tools such as ntlmrelayx and smbrelayx, which are commonly used by adversaries to perform NTLM relay attacks to gain unauthorized access or execute code on remote systems.
This rule detects the execution of common Impacket toolkit utilities, such as ntlmrelayx.py and smbserver.py, via process command line arguments. These tools are frequently used by adversaries for relay attacks, remote service execution, and credential harvesting.
Smbexec Lateral Movement
YARA-L
Detects the command line pattern characteristic of Impacket's SMBExec, involving echoing a payload to a temporary batch file, executing, and deleting it.
Detects the execution of known Impacket relay tools such as ntlmrelayx and smbrelayx, which are commonly used by adversaries to perform NTLM relay attacks to gain unauthorized access or execute code on remote systems.
Detects the execution of known Kerberoasting tools such as Rubeus and Impacket (GetST, GetTGT, asktgs) or command-line arguments indicative of Kerberoasting, specifically targeting RC4/ETYPE-23 ticket requests that are often used to crack service account passwords offline.
Detects the execution of known Impacket relay tools such as ntlmrelayx and smbrelayx, which are commonly used by adversaries to perform NTLM relay attacks to gain unauthorized access or execute code on remote systems.
This rule detects activities associated with AiTM (Adversary-in-the-Middle) attacks, specifically targeting network-based credential interception. It monitors for the execution of well-known poisoning tools (e.g., Responder), ARP spoofing utilities (e.g., ettercap, arpspoof), the creation of suspicious network listeners on protocols used for NBT-NS/LLMNR poisoning, and the execution of credential relaying tools like Impacket.
Detects attempts to access or exfiltrate the Windows Security Account Manager (SAM) or SYSTEM registry hives, which are primary targets for extracting credential hashes. This rule identifies common attack vectors including native Windows registry utilities (reg.exe), PowerShell-based volume shadow copy techniques (Invoke-NinjaCopy), and known credential dumping tools like secretsdump (from the Impacket suite) executed via command line or interpreted through Python.
Detects the command line pattern characteristic of Impacket's SMBExec, involving echoing a payload to a temporary batch file, executing, and deleting it. Threat actors use this for rapid lateral movement.
This rule detects potential lateral movement activities by monitoring Windows Event Logs for suspicious network logons combined with service installations typical of post-exploitation tools like Impacket (psexec.py, wmiexec.py, smbexec.py). It flags service names and paths that match known tool patterns, specifically looking for high-frequency lateral movement attempts within a 30-minute window, including specific command-line indicators in service image paths.
This rule monitors for indicators of Impacket toolset usage across multiple data sources, including named pipe access (Event 5145), service creation (Event 7045), scheduled task creation (Event 4698), and process execution (Event 1). It flags suspicious activity associated with modules like secretsdump, wmiexec, psexec, and smbexec, aggregating findings by source host and user to evaluate the breadth of potential unauthorized activity.
Detects the execution of Python-based SMB server implementations commonly associated with the Impacket toolset. Impacket is frequently used by attackers to facilitate lateral movement, credential relay, and remote file manipulation.
Detects the execution of Python-based SMB server implementations commonly associated with the Impacket toolset. Impacket is frequently used by attackers to facilitate lateral movement, credential relay, and remote file manipulation.
This rule detects the execution of common Python-based network relay and exploitation tools such as Impacket's ntlmrelayx, smbserver.py, and PetitPotam. These tools are frequently utilized by adversaries to conduct NTLM relay attacks, perform remote service execution, or facilitate credential dumping.
Detects the execution of known Impacket framework scripts such as psexec.py, wmiexec.py, and secretsdump.py, or command lines containing common indicators associated with these tools. The rule monitors process start events and filters for indicators of lateral movement and credential harvesting including administrative share access and lsass or ntds.dit interaction.
Page 2 of 5