Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,004 detections
Filters
Last updated
All Time
Detection languages
734
639
208
129
126
Contributors
374
315
226
187
119
Categories
564
419
368
284
263
Platforms
1,427
228
198
197
100
Products / Services
442
284
281
147
129
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
2,004
CVEs
10
9
9
8
8
IDS Classtypes
51
43
10
5
4
IDS Protocols
83
29
8
4
1
The following analytic detects SSH connections presenting client banners that do not match known, common SSH client software by leveraging Zeek ssh logs.
Unusual or unknown SSH client banners may indicate custom tooling, offensive frameworks, tunneling utilities, or malware using SSH for command-and-control or lateral movement.
Unusual or unknown SSH client banners may indicate custom tooling, offensive frameworks, tunneling utilities, or malware using SSH for command-and-control or lateral movement.
Detects the use of tscon.exe to specify a destination session without a password (potential RDP session hijacking) or the creation of a Windows service related to tscon execution.
The following analytic detects the use of the Enable-PSRemoting cmdlet, which allows PowerShell remoting on a local or remote computer. This detection leverages PowerShell Script Block Logging (EventCode 4104) to identify when this cmdlet is executed. Monitoring this activity is crucial as it can indicate an attacker enabling remote command execution capabilities on a compromised system. If confirmed malicious, this activity could allow an attacker to take control of the system remotely, execute commands, and potentially pivot to other systems within the network, leading to further compromise and lateral movement.
Detects remote service creation where the service binary is launched from an SMB administrative share (ADMIN$ or C$), indicating potential PsExec-style lateral movement.
An ABAP program invoked a remote function call (RFC) using a destination resolved at runtime, which may indicate lateral movement or unauthorized internal communication within an SAP environment.
Detects a suspicious sequence of events involving NetScaler ADC or Gateway appliances: anomalous account authentication, followed by the establishment of a VPN or remote access session, and subsequent unusual outbound network activity indicating potential lateral movement or C2 communication from the appliance.
Detects a suspicious sequence of events involving NetScaler ADC or Gateway appliances: anomalous account authentication, followed by the establishment of a VPN or remote access session, and subsequent unusual outbound network activity indicating potential lateral movement or C2 communication from the appliance.
Detects a suspicious sequence of events involving NetScaler ADC or Gateway appliances: anomalous account authentication, followed by the establishment of a VPN or remote access session, and subsequent unusual outbound network activity indicating potential lateral movement or C2 communication from the appliance.
The following analytic detects potential RDP Hijacking attempts by identifying the creation of a Windows service using sc.exe with a binary path that includes tscon.exe. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events and command-line arguments. This activity is significant as it indicates an attacker may be trying to hijack a disconnected RDP session, posing a risk of unauthorized access. If confirmed malicious, the attacker could gain control over an existing user session, leading to potential data theft or further system compromise.
Detects a suspicious sequence of events involving NetScaler ADC or Gateway appliances: anomalous account authentication, followed by the establishment of a VPN or remote access session, and subsequent unusual outbound network activity indicating potential lateral movement or C2 communication from the appliance.
Detects a suspicious sequence of events involving NetScaler ADC or Gateway appliances: anomalous account authentication, followed by the establishment of a VPN or remote access session, and subsequent unusual outbound network activity indicating potential lateral movement or C2 communication from the appliance.
Detects interactive RDP logons (LogonType 10) occurring on domain controllers or VDI authentication servers where the originating workstation name follows naming conventions associated with VDI/virtual-desktop environments. This pattern is indicative of potential lateral movement, where an adversary pivots from a compromised user VDI instance directly to sensitive infrastructure, bypassing established administrative jump box protocols.
This rule monitors for a rapid sequence of TCP SYN packets directed towards common administrative ports (SSH/22, RDP/3389, SMB/445) within a short window, indicative of an automated lateral movement scanning attempt or a brute-force discovery phase originating from within the internal network.
Detects a suspicious sequence of events involving NetScaler ADC or Gateway appliances: anomalous account authentication, followed by the establishment of a VPN or remote access session, and subsequent unusual outbound network activity indicating potential lateral movement or C2 communication from the appliance.
Detects a suspicious sequence of events involving NetScaler ADC or Gateway appliances: anomalous account authentication, followed by the establishment of a VPN or remote access session, and subsequent unusual outbound network activity indicating potential lateral movement or C2 communication from the appliance.
Detects a suspicious sequence of events involving NetScaler ADC or Gateway appliances: anomalous account authentication, followed by the establishment of a VPN or remote access session, and subsequent unusual outbound network activity indicating potential lateral movement or C2 communication from the appliance.
Detects potential Pass-the-Hash (PtH) activity by monitoring for NTLM network logons (Logon Type 3) that are associated with a blank WorkstationName, often indicating spoofing. This pattern is correlated with the assignment of special privileges (EventID 4672) to capture scenarios where stolen NTLM hashes are replayed for lateral movement into a system.
Detects anomalous lateral movement behavior where a single user account authenticates via NTLM (LogonType 3, network logon) to three or more distinct hosts within a 30-minute window, without a preceding interactive logon (LogonType 2). This pattern is a strong indicator of an adversary using captured NTLM hashes to move laterally across a Windows environment.
Detects high-frequency TCP connection attempts to WinRM (port 5985) originating from a single source host within the internal network. This pattern of behavior is often indicative of an adversary attempting to scan for or move laterally to multiple systems using WinRM.
Detects a hybrid identity attack sequence where an anomalous or high-risk cloud sign-in (e.g., AD FS, Azure AD Connect) is followed within 24 hours by suspicious on-premise Active Directory activity, specifically DCSync replication requests or Kerberoasting (high volume of TGS requests). This pattern is indicative of an attacker leveraging stolen cloud session tokens to pivot into on-premise infrastructure.
Detects anomalous outbound lateral movement attempts where a single source host initiates WinRM connections (ports 5985/5986) to an unusually high number of distinct destination hosts within a short timeframe, which is often indicative of automated credential propagation or internal scanning by an adversary.
Page 2 of 96