zeek | Detection.FYI

Detection of potential us of SMB to transfer DLL's into the C$ folder of hosts unique to Qbot malware for purposes of lateral movement.

Detection of potential us of SMB to transfer DLL's into the ProgramData folder of hosts for purposes of lateral movement.

Will detect the presence of known SSH client and SSH server strings that have been used for SSH tunneling.

Detection of a exfiltration activity using rclone from Windows network shares using SMB.

Detection of a webshell in a ManageEngine internet accessible directory.