Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,008 detections
Filters
Last updated
All Time
Detection languages
735
639
208
129
126
Contributors
374
315
226
187
119
Categories
566
420
368
284
264
Platforms
1,428
229
198
197
100
Products / Services
442
284
281
147
129
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
2,008
CVEs
10
9
9
8
8
IDS Classtypes
51
43
10
5
4
IDS Protocols
83
29
8
4
1
Detects remote RPC calls that perform remote DCOM operations, which can be abused for lateral movement via DCOM or WMI. The rule specifically looks for RPC Firewall events with EventID 3 and a set of Interface UUIDs associated with DCOM and WMI activities.
This rule detects suspicious command-line executions on Windows systems, as identified in a CISA 'Living off the Land' report. The rule looks for specific patterns in process command lines that, while potentially benign in isolation, could indicate reconnaissance, lateral movement, or data staging activities when observed in concert. Examples include the use of 7-Zip for archiving with a password, specific `pcwrun.exe` or `rar.exe` commands, `ping` commands with unusual parameters or output redirection, `dir` commands targeting network shares, `wmic` commands for process creation or `whoami` execution, `net use` commands for IPC shares, `xcopy` for data movement, and PowerShell commands to launch hidden batch files.
This rule detects remote procedure calls (RPC) targeting the MS-SRVS interface (UUID: 4b324fc8-1670-01d3-1278-5a47bf6ee188) which is associated with the Server Service. Abuse of this service can be used for lateral movement within a network, potentially for creating remote shares or other administrative functions. The detection relies on logs from an RPC Firewall.
Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR. This rule specifically looks for EventID 3 in the RPCFW EventLog, indicating a blocked or audited RPC call, and targets the InterfaceUUIDs associated with the Encrypting File System Remote (EFSR) protocol.
This rule identifies process creations or file creations where the associated file has been tagged as an 'exploit' by VirusTotal. It leverages enrichment from a VirusTotal integration to flag potentially malicious activity related to exploit execution.
This rule detects the use of the 'net use' command to connect to Windows administrative shares (C$, ADMIN$, IPC$). Adversaries often use these shares for lateral movement, file transfer, and remote execution within a network. The rule specifically looks for command-line executions containing 'net use' followed by one of the common administrative share names, case-insensitively.
This rule detects remote procedure call (RPC) activity related to the Print System Remote Protocol (MS-RPRN) and Print System Asynchronous Remote Protocol (MS-PAR) interfaces. Specifically, it looks for RPC Firewall events (EventLog: RPCFW, EventID: 3) where the InterfaceUuid matches known UUIDs associated with these printing protocols. This activity can indicate an attempt to abuse remote printing services for lateral movement within a network, potentially exploiting vulnerabilities like CVE-2021-34527 (PrintNightmare).
This rule detects the execution of PsExec via the command line on Windows systems. PsExec is a legitimate Microsoft tool that allows administrators to execute processes on remote systems, but it is also frequently abused by adversaries for lateral movement and remote execution within a compromised network.
Detects remote RPC calls to potentially abuse the Encrypting File System Remote (EFSR) protocol for lateral movement. This rule specifically looks for events from the RPC Firewall with a particular InterfaceUuid associated with MS-EFSR, indicating an attempt to interact with this service remotely.
This rule detects remote procedure calls (RPC) specifically targeting the Remote Registry Protocol (MS-RRP) interface (UUID: 338cd001-2244-31f1-aaaa-900038001003) for information collection. It filters out common administrative operations (OpNum 6, 7, 8, 13, 18, 19, 21, 22, 23, 35) to reduce false positives, focusing on suspicious reconnaissance activities against the registry from a remote system.
This rule detects the use of the 'net use' command to connect to Windows administrative shares (C$, ADMIN$, IPC$). It specifically looks for these commands being executed by users who are not part of the 'Information Technology' department or who have the title 'Intern', indicating potentially suspicious activity or a deviation from standard administrative practices. The rule leverages user enrichment data to refine its detection.
Detects instances where an FTP service on an OpenCanary honeypot has had a login attempt. This indicates an adversary is attempting to access or interact with the honeypot's services, which could be part of reconnaissance, initial access, or lateral movement activities.
This rule detects a specific lateral movement technique leveraging the MMC20.Application COM object. It identifies instances where 'mmc.exe' is spawned as a child process of 'svchost.exe' with the command line argument '-Embedding'. This behavior is indicative of the MMC20.Application COM object being used for remote code execution, often for lateral movement within a network.
Detects log entries that appear in exploitation attempts against Microsoft Exchange Remote Code Execution vulnerability CVE-2021-42321. Specifically, it looks for Event IDs 6 or 8 from the msexchange-management service containing specific error messages related to cmdlet failures or unhandled exceptions during Get-App operations, which are indicative of the exploitation.
This rule detects the creation of remote PowerShell sessions by monitoring for the 'wsmprovhost.exe' process. It triggers when 'wsmprovhost.exe' appears as either the main process image or as a parent process, indicating an active PowerShell remote session, typically facilitated by Windows Remote Management (WinRM).
Detects the execution of mstsc.exe (Microsoft Terminal Services Client) when its parent process is an uncommon application, specifically web browsers or email clients. This behavior can indicate an adversary attempting to establish an RDP connection after downloading or receiving a malicious .rdp file, potentially as part of an initial access or lateral movement attempt.
Detects rundll32 execution where the DLL is located on a remote network share (UNC path). This technique is often used by adversaries for defense evasion, execution, and lateral movement by leveraging a legitimate Windows utility to load and execute malicious code from a remote location.
Detects the execution of PsExec, a legitimate but often abused tool for remote command execution. The rule specifically looks for the executable name 'psexec.exe' or its original filename 'psexec.c' in process creation events.
This rule detects the use of 'net use' commands to connect to Windows administrative shares (C$, ADMIN$, IPC$) from a principal IP address associated with a Windows asset entity. It correlates process launch events with asset entity data, specifically looking for Windows machines within the 'Domain Computers' group. This activity can indicate lateral movement or remote access by an adversary.
This rule detects suspicious process creation patterns that may indicate FIN7 exploitation activity. Specifically, it looks for `cmd.exe` being spawned by `notepad++.exe` or `notepad++.exe` being spawned by `rdpinit.exe`. These process relationships are indicative of potential post-exploitation actions after initial access, possibly via compromised RDP credentials as described in the referenced Google blog.
This rule detects the use of the 'net use' command to connect to Windows administrative shares (C$, ADMIN$, IPC$) by users who are members of the 'Domain Admins' group. It specifically looks for process launch events where the command line contains 'net use' followed by one of the administrative share names. The rule correlates this activity with user entity data to identify if the executing user is part of the 'Domain Admins' group, indicating potential lateral movement or administrative activity.
Page 83 of 96