Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
338 detections
Filters
Last updated
All Time
Detection languages
160
100
45
16
7
Contributors
61
49
48
38
34
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
137
125
40
34
20
Products / Services
84
74
48
34
29
MITRE Techniques
127
86
48
45
36
CVEs
4
3
2
2
2
IDS Classtypes
1
1
IDS Protocols
1
Detects the addition of a new rule to the Windows Firewall exception list for an application located in a potentially suspicious location.
Detects when a firewall rule is modified or deleted in Google Cloud Platform (GCP).
Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (EDR) agents.
Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events.
Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events.
Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names.
Detects activity when The Windows Defender Firewall service failed to load Group Policy
Detects activity when Windows Defender Firewall has been reset to its default configuration
Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.
Detects when a all the rules have been deleted from the Windows Defender Firewall configuration
Detects cases where a source previously blocked by AWS WAF later receives a successful ALLOW, indicating a possible bypass attempt or rule tuning requirement after high-volume scanning.
High-fidelity correlation detecting DPRK Contagious Trader npm malware persistence: Node.js process modifying authorized_keys followed by ufw allowing SSH. Targets cryptocurrency traders via poisoned GitHub trading bot repositories.
Detects modifications to AWS EC2 security groups that allow SSH (port 22) or RDP (port 3389) access from any IP address (0.0.0.0/0) to instances. This configuration significantly increases the attack surface and can be an indicator of unauthorized access attempts, misconfigurations, or malicious activity.
High-fidelity correlation detecting DPRK Contagious Trader npm malware persistence: Node.js process modifying authorized_keys followed by ufw allowing SSH. Targets cryptocurrency traders via poisoned GitHub trading bot repositories.
Detects the use of iptables to drop incoming SSH traffic (port 22). This is a tactic used by the KadNap malware via its 'fwr.sh' script to prevent administrative access and secure its foothold on an infected device.
Detects the use of netsh.exe to create a firewall rule that blocks all outbound traffic. This technique is often used by attackers to isolate a compromised host from external resources (like security tool cloud consoles) while maintaining internal network access for lateral movement.
Detects the use of 'netsh.exe' to create firewall rules with names specific to the Prometei botnet. Prometei creates rules to allow its own C2 traffic ("Secure Socket Tunneling Protocol (HTTP)") and to block other potential attackers ("Banned brute IPs") as part of its system hardening.
Detects configuration changes on firewall devices via CommonSecurityLog.
Specifically looks for CONFIG activity that is not an audit-commit,
indicating an actual configuration change was made rather than a
read-only audit operation.
Note: Field aliasing (Client, Administrator, Host_IP, Command, Result,
Configuration_Path, Before_Change, After_Change) via extend,
fixed date window via datetime_local_to_utc, and project-reorder
are handled natively in KQL post-conversion. See third item of the
reference. Original query was scoped to a fixed date window, which is
(2026-02-09 to 2026-02-10 PST) suggesting threat hunting intent.
However, it's worthnoting that Sigma version uses a rolling 24h window
for continuous detection. This is the detection version of my KQL script.
Specifically looks for CONFIG activity that is not an audit-commit,
indicating an actual configuration change was made rather than a
read-only audit operation.
Note: Field aliasing (Client, Administrator, Host_IP, Command, Result,
Configuration_Path, Before_Change, After_Change) via extend,
fixed date window via datetime_local_to_utc, and project-reorder
are handled natively in KQL post-conversion. See third item of the
reference. Original query was scoped to a fixed date window, which is
(2026-02-09 to 2026-02-10 PST) suggesting threat hunting intent.
However, it's worthnoting that Sigma version uses a rolling 24h window
for continuous detection. This is the detection version of my KQL script.
This rule detects suspicious modifications to Remote Desktop Protocol (RDP) configurations via `reg.exe` and `netsh.exe`. Specifically, it looks for attempts to enable RDP by setting `fDenyTSConnections` to 0, modify the `UserAuthentication` setting in `RDP-Tcp` to 0, or add a firewall rule to allow RDP traffic on port 3389. These actions can indicate an adversary attempting to establish or facilitate remote access to a system.
Detects the execution of iptables to set the default policy for a chain (INPUT, OUTPUT, or FORWARD) to ACCEPT. This technique was used by a stager in a campaign delivering the Rekoobe backdoor to weaken the host's firewall posture and ensure C2 communication.
Detects the use of netsh.exe to create a firewall rule specifically named "SH Remote Access Service Launcher". This activity is associated with the JWrapper/SimpleHelp RAT, which adds this rule to allow inbound C2 connections, bypassing the system firewall.
The query, as constructed, is primarily focused on detecting large outbound traffic volumes to external destinations on a per source-destination pair basis within daily aggregations. Adjust the threshold and aggregation criteria based on your specific security requirements and typical network behavior patterns.
This rule detects configuration changes to Fortinet FortiGate firewall policies that occur outside of standard business hours (before 8 AM or after 5 PM NZDT). It specifically looks for actions like 'Move', 'Add', 'Enable', 'Delete', or 'Edit' on firewall policies. This can indicate unauthorized access or malicious activity, as legitimate changes are typically performed during business hours.
Page 11 of 17