Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
653 detections
Filters
Last updated
All Time
Detection languages
268
245
33
31
27
Contributors
207
128
118
98
20
Categories
20,456
11,839
5,876
5,155
4,865
653
Platforms
430
207
97
32
29
Products / Services
270
154
77
73
39
MITRE Techniques
326
308
201
105
97
CVEs
5
2
2
1
1
IDS Classtypes
177
67
11
9
3
IDS Protocols
129
108
16
7
3
This rule detects the use of raw sockets by 'ERAAgent.exe' by monitoring for socket I/O control (Ioctl) operations involving 'SIO_RCVALL'. This configuration, often associated with promiscuous mode, allows an application to capture all network traffic received by the network interface, a behavior commonly used by network sniffing tools or malicious implants to intercept sensitive data.
Detects anomalous network behavior where a python.exe process initiates connections to multiple internal hosts across sensitive ports (135/445/3389) in a short time frame. This pattern is indicative of reconnaissance or lateral movement staging, commonly observed with portable Python interpreters used by malware suites like Edgecution.
Detects the execution of nslookup.exe invoked by common shell programs (cmd.exe, powershell.exe, etc.) with command-line arguments indicative of network scanning or discovery activities, such as targeting specific IP addresses or requesting specific DNS record types.
This rule monitors GCP VPC Flow logs for unusual network traffic patterns originating from internal private IP address ranges (RFC 1918). It calculates daily distinct destination IP and port counts per source IP, establishing a baseline of normal behavior. It flags anomalies where current traffic ratios for destinations or ports exceed a threshold of 3x compared to the baseline, or identifies 'new host spray' patterns where a source suddenly targets an unusually high number of ports or destinations without prior history, indicating potential reconnaissance or scanning activity.
Detects high-frequency HTTP GET request patterns indicative of bulk vulnerability scanning using the Nuclei scanner against public-facing web services. The rule triggers when a source IP initiates 250 or more requests within a 300-second window, excluding pre-authorized scanner source IP addresses.
Detects ChonkyChicken's recon module by correlating TCP port scanning with ARP sweep or SMB share enumeration from the same host.
Detects instances where the 'claude' or 'claude-code' process initiates network connections to more than 20 distinct destination IP addresses within a short 5-minute window. This behavior is indicative of a tool performing automated network scanning or discovery activities.
Detects a single host rapidly initiating outbound Telnet (port 23) or SSH (port 22) connection attempts against a large number of distinct remote IP addresses in a short window. This behavior is indicative of bot-agent scanners, such as those associated with IoT botnets, attempting to propagate by performing brute-force login attempts using default credential pairs.
Detects anomalous web server scanning activity where a single source IP performs rapid requests against multiple common administrative or login panel paths (/admin, /wp-admin, etc.) while utilizing randomized ephemeral source ports. This behavior is consistent with automated enumeration scanning, such as that performed by the TuxBot v3 malware.
Detects an internal host performing network scanning against multiple internal IP addresses or multiple ports, which is indicative of lateral movement, reconnaissance, or automated worm-like activity within the local network.
This rule detects a suspicious sequence of events where a device loads a specific DLL named 'n-ten.dll' and subsequently engages in high-volume network connection activity within a short time window. The rule alerts on endpoints that perform network scanning (defined by a threshold of distinct remote IPs or ports) shortly after the specified module load, which is a common behavior pattern for malicious payloads or backdoors initiating internal reconnaissance or lateral movement.
Detects the execution of NetScan.exe, a common network scanning tool often used by adversaries to perform internal network reconnaissance and identify active hosts and services within a compromised environment.
Detects anomalous internal network activity where a single host attempts to connect to multiple unique internal IP addresses across various ports within a short timeframe. This behavior is indicative of lateral movement reconnaissance or port scanning within the internal network.
Detects the execution of the FortigateSniffer binary or the use of the 'diagnose sniffer packet' command on FortiGate devices, which are used to passively intercept network traffic including authentication protocols like RADIUS, NTLM, and Kerberos.
This rule detects potential network port scanning behavior by identifying a host that initiates connections to both ports 3333 and 3334 on a remote destination within a short time window (15 seconds). This specific pattern is often associated with automated discovery or lateral movement tools probing for specific services.
This rule detects a suspicious pattern involving mass HTTP scraping behavior (high frequency of requests to numerous distinct remote IP addresses) occurring on the same host, correlated with the creation of multiple new user accounts (Windows Event ID 4720) within the same 30-minute time window. This behavior is indicative of a compromised host being used for automated reconnaissance or data collection alongside persistence mechanism establishment.
Detects the use of the 'diagnose sniffer packet' command on a FortiGate network device, which is indicative of an administrator or attacker performing network traffic capture and analysis directly from the device's management interface.
Detects a single source IP address initiating Remote Desktop Protocol (Logon Type 10) connections to three or more distinct computer destinations within a 10-minute window. This behavior is indicative of lateral movement or internal network scanning activity.
This rule detects suspicious network connections originating from internal IP addresses to common service ports (DNS, SMB, RDP, WinRM) on remote, non-internal IP addresses. It flags instances where a single process on a device makes 10 or more such connections within an hour, which could indicate reconnaissance, lateral movement, or data exfiltration attempts.
Detects high-frequency, sequential authentication failures across multiple internal targets (SMB/LDAP) initiated from a single internal IP address. This behavior is consistent with credential spraying or lateral movement reconnaissance tools like NetExec or similar automation scripts, often originating from compromised internal assets such as virtual machines.
This rule detects potential automated reconnaissance or credential harvesting by monitoring for high volumes of LDAP queries targeting sensitive Active Directory attributes. It correlates both LDAP query events and Windows Security Event ID 4662 to identify bulk access to attributes like 'samAccountName', 'userPassword', and 'memberOf'.
Page 12 of 32