Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,004 detections
Filters
Last updated
All Time
Detection languages
734
639
208
129
126
Contributors
374
315
226
187
119
Categories
564
419
368
284
263
Platforms
1,427
228
198
197
100
Products / Services
442
284
281
147
129
MITRE Techniques
18,115
15,635
12,577
8,388
6,215
2,004
CVEs
10
9
9
8
8
IDS Classtypes
51
43
10
5
4
IDS Protocols
83
29
8
4
1
Detects suspicious access to Microsoft Teams application's authentication tokens and local storage, which may contain sensitive credentials. This rule specifically looks for Event ID 4663 (Object Access) where the accessed object path contains '\Microsoft\Teams\Cookies' or '\Microsoft\Teams\Local Storage\leveldb', and the accessing process is NOT the legitimate 'Teams.exe'. This indicates an attempt by an unauthorized process to steal Teams authentication tokens.
Detects lateral movement activity using various Impacket tools such as wmiexec, dcomexec, atexec, and smbexec. The rule identifies specific parent processes and command-line arguments indicative of these tools, which often involve `cmd.exe` executing commands with output redirection to a local loopback address.
Detects the installation of services that are characteristic of Metasploit's SMB PsExec module (exploit/windows/smb/psexec) and Impacket's psexec.py. The rule specifically looks for Windows Security Event ID 4697 (A service was installed in the system) where the ServiceFileName matches a pattern of '%systemroot%\<8_random_chars>.exe' and the ServiceName matches a pattern of 4, 8, or 16 alphabetic characters, while excluding the known legitimate 'PSEXESVC' service.
This rule detects specific command-line activities associated with the Turla APT group's lateral movement and discovery tactics. It looks for the use of 'net use' to connect to administrative shares (specifically C$) with a hardcoded password, and 'dir' commands used for file and directory discovery, targeting document files and executables in the TEMP directory. These commands are indicative of an adversary attempting to move laterally within a network and gather information about the environment.
This rule detects when an external disk drive or a USB mass storage device is recognized by the system. It specifically looks for Windows Security Event ID 6416, which indicates that a new external device was recognized, and further filters for devices classified as 'DiskDrive' or with the description 'USB Mass Storage Device'. This can be an indicator of initial access, data exfiltration, or the introduction of malicious software via removable media.
This rule detects the execution of the PowerShell cmdlet 'Enable-PSRemoting'. This cmdlet configures the computer to receive PowerShell remote commands, which adversaries may use for lateral movement and remote execution. Detection relies on Script Block Logging being enabled to capture the cmdlet's execution.
This rule detects RDP traffic communicating with the loopback address (127.0.0.1 or ::1) on either the source or destination port 3389, specifically looking for Windows Filtering Platform (WFP) events (EventID 5156). This behavior is indicative of RDP over a reverse SSH tunnel, where RDP traffic is redirected locally to bypass network restrictions or for covert communication. The rule explicitly filters out events originating from 'AppContainer Loopback' and known Thor processes to reduce false positives.
Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify successful exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.
RDP login with localhost source address may be a tunnelled login
Detects the use of the 'spoolss' named pipe over SMB, which can be leveraged to trigger NTLM authentication from a target machine with the print spooler service enabled. This technique is often used in NTLM relay attacks or other forms of printer spooler abuse to gain unauthorized access or escalate privileges.
This rule detects attempts to exploit the Zerologon vulnerability (CVE-2020-1472) using tools like Mimikatz or other exploits originating from a machine with 'kali' in its hostname. It specifically looks for Windows System event IDs 5805 or 5723 in conjunction with the keywords 'kali' or 'mimikatz'.
Detects a suspicious RDP session redirect using the 'tscon.exe' utility with the '/dest:rdp-tcp#' command-line argument. This technique can be used by adversaries to hijack an existing RDP session, potentially leading to privilege escalation or lateral movement.
Detects svchost.exe initiating an outbound network connection on TCP port 3389 (RDP) to a loopback address (127.0.0.0/8 or ::1/128). This behavior is indicative of RDP traffic being tunneled, potentially via a reverse SSH tunnel, to bypass network restrictions or for covert remote access.
Detects the use of NTLMv1 for authentication between a client and server. NTLMv1 is an insecure authentication protocol due to its susceptibility to brute-force attacks against its underlying encryption algorithms. This rule identifies events logged by the LsaSrv provider indicating NTLMv1 usage.
Detects non-standard tools initiating outbound connections over port 3389, which is commonly used for Remote Desktop Protocol (RDP). This activity can indicate possible lateral movement within a network. The rule filters out legitimate RDP clients and other known third-party tools to reduce false positives. An initial baseline of legitimate RDP tooling is required for effective use.
Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario. This rule specifically looks for EventID 5145 (a network share access event) where the target file path ends with `\Internet Explorer\iertutil.dll` and the `SubjectUserName` does not end with a `$` (indicating a machine account, which is filtered out to reduce false positives).
Detects network access to the 'protected_storage' service, specifically targeting the IPC$ share. This activity is often associated with attempts to extract DPAPI domain backup keys from Domain Controllers, a technique used for credential access and lateral movement.
Detects inbound network connections to ports 5985 or 5986, which are commonly used for PowerShell Remoting (WinRM). This rule specifically looks for EventID 5156 (Windows Filtering Platform Connection) with a LayerRTID of 44, indicating an inbound connection.
Detects the use of the spoolss named pipe over SMB. This can be used to trigger NTLM authentication from machines with the spooler service enabled, often as part of NTLM relay attacks or credential harvesting.
Detects instances where the svchost.exe process, specifically hosting the RDP terminal services, initiates outbound network connections to target systems on standard HTTP (TCP port 80) or HTTPS (TCP port 443) ports. This behavior is indicative of RDP tunneling, where RDP traffic is encapsulated within web protocols to bypass network restrictions or evade detection.
This rule detects the execution of 'ssh.exe' with command-line arguments indicating RDP port forwarding (tunneling). Specifically, it looks for the presence of ':3389' in the command line, which is the default port for RDP. This activity can be used by adversaries to establish a tunnel for remote access, bypassing network restrictions and potentially exfiltrating data.
Page 90 of 96