Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,006 detections
Filters
Last updated
All Time
Detection languages
735
639
208
129
126
Contributors
374
315
226
187
119
Categories
566
420
368
284
264
Platforms
1,428
229
198
197
100
Products / Services
442
284
281
147
129
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
2,006
CVEs
10
9
9
8
8
IDS Classtypes
51
43
10
5
4
IDS Protocols
83
29
8
4
1
Detects instances where the svchost.exe process, specifically hosting the RDP terminal services, initiates outbound network connections to target systems on standard HTTP (TCP port 80) or HTTPS (TCP port 443) ports. This behavior is indicative of RDP tunneling, where RDP traffic is encapsulated within web protocols to bypass network restrictions or evade detection.
This rule detects the execution of 'ssh.exe' with command-line arguments indicating RDP port forwarding (tunneling). Specifically, it looks for the presence of ':3389' in the command line, which is the default port for RDP. This activity can be used by adversaries to establish a tunnel for remote access, bypassing network restrictions and potentially exfiltrating data.
Detects scenarios where the OpenSSH server starts listening on an SSH socket, which could indicate an attacker enabling the service for remote access or persistence. This rule specifically looks for EventID 4 from the OpenSSH service with the process name 'sshd' and a payload starting with 'Server listening on '.
Detects suspicious processes, including various shells and utilities, spawned by the WinRM host process (wsmprovhost.exe). This activity can indicate an adversary using WinRM for remote execution, potentially for initial access, persistence, or privilege escalation.
Detects the modification of the PortProxy registry key, which is used for port forwarding. This can indicate an adversary setting up a proxy for lateral movement or command and control.
This rule detects remote access to the Local Security Authority Subsystem Service (LSASS) process via Windows Remote Management (WinRM). This activity is highly indicative of credential dumping attempts, often performed by tools like Mimikatz, to extract sensitive authentication material from memory. The rule specifically looks for process access events where the target process is 'lsass.exe' and the source process initiating the access is 'wsmprovhost.exe', which is associated with WinRM. It also filters out common benign access patterns (0x80000000 GrantedAccess) to reduce false positives.
Detects when the Microsoft Management Console (MMC) spawns a Windows shell or command-line executable. This behavior can indicate an adversary abusing the MMC2.0 Application COM object for remote code execution or lateral movement. The rule specifically looks for mmc.exe as the parent process of common shell executables like cmd.exe, powershell.exe, wscript.exe, cscript.exe, reg.exe, regsvr32.exe, or other scripting/command interpreters.
Detects a process spawned by the terminal service server process (termsvcs), which could indicate an exploitation attempt of CVE-2019-0708, commonly known as BlueKeep. The rule specifically looks for processes where the parent command line contains both 'svchost.exe' and 'termsvcs', while filtering out legitimate processes like rdpclip.exe, csrss.exe, wininit.exe, and winlogon.exe.
This rule detects the first-time observation of remote named pipe connections, excluding a predefined list of common and legitimate named pipes. This behavior is often indicative of lateral movement or remote execution using named pipes, which attackers commonly leverage to move within a network or execute code on remote systems. The rule specifically looks for connections to '\\*\IPC$', a common administrative share used for interprocess communication over a network. By filtering out known legitimate named pipes, the rule aims to reduce false positives and highlight potentially malicious activity.
Detects events generated by user-mode applications when they call the CveEventWrite API, indicating that a known vulnerability is potentially being exploited. Microsoft started using this log in January 2020, notably with CVE-2020-0601 (a Windows CryptoAPI vulnerability). However, the rule's description notes that this log has historically seen limited use for reporting CVEs.
This rule detects the execution of `ruby.exe` with command-line arguments indicative of Evil-WinRM usage. Specifically, it looks for the presence of `-i`, `-u`, and `-p` flags, which are commonly used by Evil-WinRM for specifying the target IP address, username, and password for Windows Remote Management (WinRM) access. This activity suggests an adversary is attempting to establish remote control over a system using a known penetration testing tool.
Detects logon events (Event ID 4672 and 4964) involving accounts with special privileges or belonging to special groups, such as administrators. The rule filters out the local system account (S-1-5-18) and allows for a configurable filter for valid internal accounts to reduce false positives.
This rule detects the execution of PsExec or PAExec by monitoring network share access to the IPC$ share. Specifically, it looks for access to named pipes ending with '-stdin', '-stdout', or '-stderr', which are characteristic of PsExec/PAExec communication. The rule filters out instances where the service name starts with 'PSEXESVC', indicating the standard Sysinternals PsExec service, to reduce false positives for legitimate PsExec usage or when the attacker uses a different PsExec client.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario. This is identified by monitoring Windows Security Event ID 5145 for file creations ending with `\wbem\wbemcomn.dll` and filtering out legitimate system accounts (those ending with '$').
Detects the installation of a service by the smbexec.py tool, identified by a specific service name ('BTOBTO') and characteristic command-line arguments in the ImagePath, which typically involve executing a batch script and redirecting output.
Detects cases where ngrok, a legitimate reverse proxy tool, is used to forward traffic to the local Remote Desktop Protocol (RDP) port. This activity can indicate malicious behavior, as adversaries often use tools like ngrok for command and control, bypassing firewalls, or establishing persistent remote access to compromised systems.
Detects the execution of copy commands or utilities (robocopy, xcopy, cmd copy, PowerShell Copy-Item/Move-Item) targeting or originating from Windows Admin shares (e.g., C$) or the Sysvol folder. This activity can indicate lateral movement, data collection, or exfiltration by an adversary.
This rule detects the potential use of an SSH utility to establish Remote Desktop Protocol (RDP) over a reverse SSH Tunnel. Attackers commonly use this technique to enable routing of network packets that would otherwise not reach their intended destination, bypassing network segmentation or firewalls. The detection logic looks for command-line arguments containing the RDP port ':3389' in conjunction with common SSH tunneling switches such as '-L', '-P', '-R', '-pw', or '-ssh'.
This rule detects the use of PowerShell to mount Server Message Block (SMB) shares over the QUIC transport protocol. This activity, while legitimate, can be unusual in some enterprise environments and may indicate an adversary attempting to establish lateral movement or data transfer channels using a less common protocol.
This rule detects the first-time use of a remote named pipe, excluding commonly known legitimate pipes. This can help identify lateral movement and remote execution attempts using named pipes, as adversaries often leverage these for inter-process communication across networked systems.
Detects the use of MSTSC (Microsoft Terminal Services Client) with specific command-line arguments ('noconsentprompt' and 'shadow:') which indicates an attempt to perform RDP session shadowing without user consent. This technique can be used for RDP session hijacking.
Page 91 of 96