Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,006 detections
Filters
Last updated
All Time
Detection languages
735
639
208
129
126
Contributors
374
315
226
187
119
Categories
566
420
368
284
264
Platforms
1,428
229
198
197
100
Products / Services
442
284
281
147
129
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
2,006
CVEs
10
9
9
8
8
IDS Classtypes
51
43
10
5
4
IDS Protocols
83
29
8
4
1
Detects the use of legitimate SSH clients (ssh.exe, plink.exe) to initiate outbound network connections to internal IP ranges on port 22. This activity is consistent with Obsidian Sandstorm lateral movement tactics, where compromised credentials are used to establish SSH tunnels for internal network pivoting.
This rule detects successful SSH login attempts from external IP addresses (not within common private IP ranges). It specifically looks for 'Accepted' messages in syslog from the 'sshd' process and filters out internal source IPs.
Detects the use of the 'net.exe' or 'net1.exe' command-line utilities to mount a local SMB share using loopback addresses (127.0.0.1 or localhost) with the '/tcpport' argument. This pattern is indicative of attempts to exploit CVE-2026-24294 to bypass NTLM authentication protections through local reflection or relay attacks.
This rule monitors for two high-risk behaviors related to Remote Desktop Protocol (RDP) usage: 1) The mstsc.exe process spawning suspicious administrative or scripting tools, and 2) Successful RDP logins originating from non-RFC1918 (external) IP addresses or occurring during non-standard business hours (08:00 PM to 06:00 AM). These patterns are indicative of potential initial access, lateral movement, or post-exploitation activities via RDP.
Detects potential lateral movement activity involving Windows Remote Management (WinRM). The rule monitors for common WinRM-related tools (winrs.exe), PowerShell WinRM cmdlets (e.g., Invoke-Command) targeting non-local systems, and the spawning of suspicious processes by the WinRM host process (wsmprovhost.exe).
This rule detects network traffic indicative of PsExec lateral movement, specifically identifying the authentication or access to the hidden 'ADMIN$' network share followed by the transfer or execution of the 'PSEXESVC' service binary, a hallmark of the PsExec tool.
Detects HTTP requests containing directory traversal patterns (e.g., ../, %2e%2e/) combined with attempts to access sensitive system files like /etc/passwd, shadow files, or Windows system configuration files (boot.ini, win.ini).
This rule monitors for two high-risk behaviors related to Remote Desktop Protocol (RDP) usage: 1) The mstsc.exe process spawning suspicious administrative or scripting tools, and 2) Successful RDP logins originating from non-RFC1918 (external) IP addresses or occurring during non-standard business hours (08:00 PM to 06:00 AM). These patterns are indicative of potential initial access, lateral movement, or post-exploitation activities via RDP.
Detects Active Directory logons (Event IDs 4624, 4768, 4769) originating from the Fortinet SSL VPN IP pool. In the context of the FortiBleed credential-harvesting campaign, attackers utilize compromised Fortinet VPN credentials to immediately pivot into internal Active Directory environments. Because pure Sigma rules evaluate a single log source, this rule targets the Windows AD telemetry. To achieve the highest fidelity, this rule should be correlated in your SIEM with FortiGate SSL VPN tunnel-up events (e.g., Event Code 32130, 39424) originating from anomalous external IPs for the same principal within a short time window.
Detects messages sent within Microsoft Teams from an external tenant that contain potentially malicious indicators, such as URL shorteners, external links, or references to executable file extensions. This rule is designed to identify potential spearphishing or social engineering attempts originating from external Microsoft 365 tenants.
Detects anomalous device code authentication sessions originating from non-corporate IP addresses using common command-line user agents, which are immediately followed by a device registration event by the same user. This pattern is indicative of OAuth device code phishing, where an attacker tricks a user into authorizing a malicious application to access their account.
Smbexec Lateral Movement
YARA-L
Detects the command line pattern characteristic of Impacket's SMBExec, involving echoing a payload to a temporary batch file, executing, and deleting it.
Detects execution of the SSH binary with command-line arguments indicative of port forwarding, specifically remote port forwarding (-R) or use of specific ports and IP addresses often associated with unauthorized proxying or command and control tunnels.
Detects Remote Desktop (RDP) logon events (LogonType 10) initiated by common privileged or service-oriented accounts such as administrator, backup_EA, or backup_DA. This behavior may indicate unauthorized remote access or credential abuse using highly privileged accounts.
This rule detects potential RDP lateral movement by identifying accounts that log on to multiple distinct workstations via RDP (LogonType 10) within a one-hour window, where the workstation name is different from the computer name. A logon chain of more than two distinct computers for the same account and IP address within an hour is flagged as suspicious.
Detects instances where the RustDesk application process launches suspicious child processes (e.g., cmd.exe, powershell.exe, wscript.exe) that are not associated with legitimate administrative functions (like installation or service management). This pattern indicates potential exploitation of RustDesk session permission bypass vulnerabilities to execute arbitrary commands on a remote system.
Detects reconnaissance and post-exploitation activity associated with the exploitation of the libssh2 CVE-2026-55200 vulnerability. The rule identifies the execution of known libpwn PoC binaries, libssh2-dependent client applications (curl, git, php) spawning unexpected shell processes, and unauthorized access to SSH-related configuration or key files by non-interactive processes.
Detects path traversal exploitation attempts targeting Dell Wyse Management Suite (WMS) processes or Java components, specifically looking for attempts to access sensitive system files such as SAM, NTDS.dit, or registry hive files via directory traversal sequences.
This rule detects potential exploitation of the CVE-2026-48558 vulnerability in SimpleHelp servers by monitoring for specific sequences of log markers related to authentication bypass and unauthorized configuration changes. It flags anomalous technician registrations, OIDC attribute fetching, and 'New Anon' configuration saves within a 60-second window, which are indicative of an attacker attempting to gain unauthorized access or manipulate session security.
Detects a critical authentication bypass in SimpleHelp servers (CVE-2026-48558) where an adversary leverages a forged OIDC identity token. The rule identifies the sequence of an unverified OIDC response, the failure to issue an MFA session token, successful group-level authentication without a challenge, and the subsequent registration of an unauthenticated '[New Anon]' identity.
Detects rapid succession of power-off, suspend, or destroy operations on virtual machines via esxcli or vim-cmd following an SSH login, a behavior pattern often associated with ESXi ransomware activity (e.g., Qilin).
Page 9 of 96