| elastic |
Potential Lateral Tool Transfer via SMB Share |
production |
2026-10-19 |
| splunk |
Impacket Lateral Movement WMIExec Commandline Parameters |
production |
2026-10-09 |
| splunk |
Detect PsExec With accepteula Flag |
production |
2026-10-09 |
| elastic |
SMB Connections via LOLBin or Untrusted Process |
production |
2026-10-06 |
| splunk |
Windows Alternate Data Stream Created Over Local Share |
production |
2026-09-30 |
| splunk |
Windows Suspicious Named Pipe |
production |
2026-09-22 |
| splunk |
Windows Suspicious C2 Named Pipe |
production |
2026-09-22 |
| splunk |
Windows RMM Named Pipe |
production |
2026-09-22 |
| splunk |
Windows PUA Named Pipe |
production |
2026-09-22 |
| elastic |
Lateral Movement via Startup Folder |
production |
2026-09-18 |
| elastic |
Service Command Lateral Movement |
production |
2026-09-18 |
| elastic |
Potential Ransomware Note File Dropped via SMB |
production |
2026-09-18 |
| elastic |
Suspicious File Renamed via SMB |
production |
2026-09-18 |
| elastic |
Potential Ransomware Behavior - Note Files by System |
production |
2026-09-18 |
| elastic |
Suspicious Process Execution via Renamed PsExec Executable |
production |
2026-09-18 |
| elastic |
Suspicious Execution from a WebDav Share |
production |
2026-09-18 |
| elastic |
PsExec Network Connection |
production |
2026-09-18 |
| elastic |
Potential PowerShell HackTool Script by Function Names |
production |
2026-09-18 |
| elastic |
Suspicious Remote Registry Access via SeBackupPrivilege |
production |
2026-09-18 |
| elastic |
Protected Storage Service Access via SMB |
production |
2026-09-18 |
| elastic |
Windows Registry File Creation in SMB Share |
production |
2026-09-18 |
| elastic |
Potential Machine Account Relay Attack via SMB |
production |
2026-09-18 |
| elastic |
Attempt to Mount SMB Share via Command Line |
production |
2026-09-18 |
| elastic |
Remote Windows Service Installed |
production |
2026-09-18 |
| elastic |
Remote File Copy to a Hidden Share |
production |
2026-09-18 |
| elastic |
Mounting Hidden or WebDav Remote Shares |
production |
2026-09-18 |
| elastic |
Remote Execution via File Shares |
production |
2026-09-18 |
| elastic |
NullSessionPipe Registry Modification |
production |
2026-09-18 |
| splunk |
Executable File Written in Administrative SMB Share |
production |
2026-08-05 |
| sigma |
Rundll32 UNC Path Execution |
test |
2026-07-20 |
| splunk |
Windows Special Privileged Logon On Multiple Hosts |
production |
2026-05-13 |
| splunk |
Impacket Lateral Movement Commandline Parameters |
production |
2026-05-13 |
| splunk |
Impacket Lateral Movement smbexec CommandLine Parameters |
production |
2026-05-13 |
| splunk |
SMB Traffic Spike |
experimental |
2026-05-13 |
| splunk |
Windows Theme File Creation in Unusual Location |
production |
2026-05-13 |
| sigma |
HackTool - NetExec File Indicators |
experimental |
2026-04-08 |
| sigma |
Copy From Or To Admin Share Or Sysvol Folder |
test |
2025-10-22 |
| sigma |
Unsigned or Unencrypted SMB Connection to Share Established |
experimental |
2025-10-19 |
| sigma |
SMB Create Remote File Admin Share |
test |
2025-10-17 |
| sigma |
Remote Service Activity via SVCCTL Named Pipe |
test |
2024-08-01 |
| sigma |
Potential CobaltStrike Service Installations - Registry |
test |
2024-03-25 |
| sigma |
HackTool - SharpMove Tool Execution |
test |
2024-01-29 |
| sigma |
Metasploit SMB Authentication |
test |
2024-01-25 |
| sigma |
Access To ADMIN$ Network Share |
test |
2024-01-16 |
| sigma |
PUA - CSExec Default Named Pipe |
test |
2023-11-30 |
| sigma |
PUA - RemCom Default Named Pipe |
test |
2023-11-30 |
| sigma |
smbexec.py Service Installation |
test |
2023-11-09 |
| sigma |
Windows Internet Hosted WebDav Share Mount Via Net.EXE |
test |
2023-07-25 |
| sigma |
First Time Seen Remote Named Pipe |
test |
2023-03-14 |
| sigma |
Rundll32 Execution Without Parameters |
test |
2023-02-28 |
| sigma |
Windows Admin Share Mount Via Net.EXE |
test |
2023-02-21 |
| sigma |
Windows Share Mount Via Net.EXE |
test |
2023-02-21 |
| sigma |
Password Provided In Command Line Of Net.EXE |
test |
2023-02-21 |
| sigma |
First Time Seen Remote Named Pipe - Zeek |
test |
2022-12-27 |
| sigma |
Suspicious PsExec Execution - Zeek |
test |
2022-12-27 |
| sigma |
Potential DCOM InternetExplorer.Application DLL Hijack - Image Load |
test |
2022-12-18 |
| sigma |
Potential DCOM InternetExplorer.Application DLL Hijack |
test |
2022-12-18 |
| sigma |
Wmiprvse Wbemcomn DLL Hijack - File |
test |
2022-12-02 |
| sigma |
CobaltStrike Service Installations - System |
test |
2022-11-27 |
| sigma |
CobaltStrike Service Installations - Security |
test |
2022-11-27 |
| sigma |
DCOM InternetExplorer.Application Iertutil DLL Hijack - Security |
test |
2022-11-26 |
| sigma |
Wmiprvse Wbemcomn DLL Hijack |
test |
2022-10-09 |
| sigma |
SMB Spoolss Name Piped Usage |
test |
2022-10-09 |
| sigma |
Turla Group Lateral Movement |
test |
2022-10-09 |
| sigma |
Metasploit Or Impacket Service Installation Via SMB PsExec |
test |
2022-10-05 |
| sigma |
Impacket PsExec Execution |
test |
2022-09-22 |
| sigma |
Suspicious New-PSDrive to Admin Share |
test |
2022-08-13 |
| sigma |
Suspicious PsExec Execution |
test |
2022-08-11 |
| sigma |
DCERPC SMB Spoolss Named Pipe |
test |
2022-08-11 |
| sigma |
Net.EXE Execution |
test |
2022-07-11 |
| sigma |
T1047 Wmiprvse Wbemcomn DLL Hijack |
test |
2022-02-24 |
| sigma |
Protected Storage Service Access |
test |
2021-11-27 |