Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
338 detections
Filters
Last updated
All Time
Detection languages
160
100
45
16
7
Contributors
61
49
48
38
34
Categories
20,453
11,837
5,876
5,154
4,865
Platforms
137
125
40
34
20
Products / Services
84
74
48
34
29
MITRE Techniques
127
86
48
45
36
CVEs
4
3
2
2
2
IDS Classtypes
1
1
IDS Protocols
1
Detects the use of the netsh.exe utility to modify Windows Advanced Firewall settings, specifically disabling profiles or adding/deleting firewall rules. This activity is often used by adversaries to impair security controls on a compromised host.
Detects potential exploitation of CVE-2026-0300 targeting PAN-OS and matches anomalous User-Agent string associated with CL-STA-1132 threat actor.
Detects a sequence of actions characteristic of LCRYX ransomware: disabling Windows Defender via registry modification, disabling the Windows Firewall via netsh, and terminating common antivirus processes (e.g., MsMpEng, avp, vsserv) within a 10-minute window on the same host.
Detects the use of netsh.exe to create a firewall rule specifically named "SH Remote Access Service Launcher". This activity is associated with the JWrapper/SimpleHelp RAT, which adds this rule to allow inbound C2 connections, bypassing the system firewall.
Detects encrypted WebSocket sessions over non-standard ports or TLS traffic patterns indicative of Bluekit Phishing-as-a-Service (PaaS) session token exfiltration to unauthorized command and control (C2) infrastructure.
This rule detects a suspicious sequence of events: the enablement of Remote Desktop Protocol (RDP) via registry modification, followed by the creation of a new local administrator account with password expiration disabled, potentially accompanied by a netsh firewall rule modification to allow RDP. This combination of actions is highly indicative of an adversary establishing persistent remote access and creating a backdoor account.
Detects the netsh utility being abused to explicitly open port 3389 in the Windows Defender Firewall to allow inbound RDP traffic.
This rule detects attempts to disable, stop, or tamper with security-critical Linux system services and configurations. This includes stopping AppArmor, disabling firewalls (iptables, nftables, ufw), disabling SELinux, and modifying file attributes with 'chattr' to potentially hinder security monitoring or unauthorized file modifications.
Detects high-frequency port scanning activity from external, non-private IP addresses targeting common network services. The rule identifies different scanning profiles, including wide port sweeps and targeted multi-port scans, which are consistent with reconnaissance behaviors observed in botnet activity like the KV/JDY clusters.
This rule detects various activities related to the installation, configuration, and execution of OpenSSH on Windows systems. It looks for processes adding the OpenSSH server capability, creating the sshd service, generating SSH keys, and the execution of the sshd.exe process. It also includes a specific hash for a known malicious SSH artifact and firewall rule additions containing 'SSH'.
This rule detects various activities associated with the RustDesk remote access tool, including process execution, file staging (RustCustom.zip or rustdesk.exe by hash), firewall rule creation for RustDesk, and service installation related to RustDesk. Detection is based on process names, file names, SHA256 hashes, firewall rule names, and service names.
Detects credential abuse patterns from FortiGate logs including administrative changes, tunneling activity, and anomalous source-IP behavior.
Detects the netsh utility being invoked to explicitly add firewall exclusions for the TiFlux executables to ensure uninterrupted C2.
Detects attempts to disable or flush system firewall rules on Linux platforms using common utilities like iptables, ufw, or nftables. Adversaries perform these actions to bypass network access controls and facilitate malicious activities such as command and control communications or lateral movement.
Detects the use of the 'netsh' utility to add 'allow' or 'bypass' rules to the Windows Advanced Firewall. This behavior is frequently used by adversaries to facilitate persistence or lateral movement by opening network ports while bypassing existing security controls.
This rule detects the execution of iptables or xtables commands to create a network redirection rule. Specifically, it looks for commands that use 'REDIRECT', '--to-ports', and either 'PREROUTING' or 'nat' in the command line, indicating an attempt to redirect network traffic, potentially for proxying or other malicious network manipulation.
Detects the creation of an inbound allow firewall rule by 'netsh' or 'powershell' when launched from a user-writable location (e.g., Temp, AppData, ProgramData, Users\Public). This rule aims to identify potentially malicious activity where an attacker might be establishing persistence or enabling command and control communication by modifying host firewall settings.
Detects the creation of an inbound allow firewall rule by 'netsh' or 'powershell' when launched from a user-writable location (e.g., Temp, AppData, ProgramData, Users\Public). This rule aims to identify potentially malicious activity where an attacker might be establishing persistence or enabling command and control communication by modifying host firewall settings.
This rule detects the creation of an inbound firewall allow rule by `netsh` or `powershell` when the initiating process (actor) is launched from a user-writable location such as `temp`, `appdata`, `programdata`, or `users\public`. This behavior can indicate malicious activity where an adversary attempts to establish network access or persistence by modifying firewall settings from an unusual or untrusted execution path.
Detects outbound network connections to the attacker-controlled infrastructure
used in the June 2026 Mastra npm supply chain attack (easy-day-js campaign).
IP 23.254.164.92 served the second-stage payload; 23.254.164.123 was the C2
exfiltration server for the cross-platform infostealer.
used in the June 2026 Mastra npm supply chain attack (easy-day-js campaign).
IP 23.254.164.92 served the second-stage payload; 23.254.164.123 was the C2
exfiltration server for the cross-platform infostealer.
Detects the writing and subsequent deletion of Azure SQL firewall rules, a technique used to enable remote access and evade defenses. This behavior could indicate an adversary attempting to open up network access to an Azure SQL server and then remove the evidence of the rule change.
Page 9 of 17