Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
653 detections
Filters
Last updated
All Time
Detection languages
268
245
33
31
27
Contributors
207
128
118
98
20
Categories
20,456
11,839
5,876
5,155
4,865
653
Platforms
430
207
97
32
29
Products / Services
270
154
77
73
39
MITRE Techniques
326
308
201
105
97
CVEs
5
2
2
1
1
IDS Classtypes
177
67
11
9
3
IDS Protocols
129
108
16
7
3
This rule monitors network traffic to detect potential scanning activity by identifying single remote IP addresses communicating with more than 50 distinct internal hostnames within the observed timeframe. This behavior is often indicative of automated reconnaissance, such as vulnerability scanning or network discovery, performed by an adversary attempting to map the environment.
This rule detects potential reconnaissance activity by identifying IP addresses that generate a high volume of HTTP requests with user agents indicating bots, crawlers, or scanners. It counts requests per IP address within one-hour bins and flags those with 50 or more such requests.
This rule detects potential vulnerability scanning activity by identifying multiple network connection attempts to common vulnerable ports (135, 139, 445) where the remote URL contains keywords like 'vuln' or 'scan'. It aggregates these activities by device and time, flagging devices with 5 or more such connections within an hour.
This rule detects potential vulnerability scanning activity by identifying devices making multiple successful network connections to specific ports commonly used by vulnerability scanners (8834, 8889, 1241). A device is flagged if it makes 3 or more such connections within a one-hour window.
Detects potential exploitation attempts against management interfaces of SOHO network devices (Cisco, Ubiquiti, Draytek) by monitoring for suspicious web request activity, specifically targeting paths like /admin, /cgi-bin, or /setup.cgi. The rule identifies high-volume or systematic scan patterns from external sources, which may indicate automated exploitation attempts (e.g., related to CVE-2026-35616).
Detects high frequency inbound network connection attempts or accepted connections initiated by common file sharing processes (e.g., NearShare.exe, NearbySharing.exe, quickshare.exe, sharingd, airplayd). A high volume of inbound connection attempts may indicate brute force, discovery, or malicious scanning behavior using legitimate file sharing tools as a conduit.
This rule detects potential automated reconnaissance or credential harvesting by monitoring for high volumes of LDAP queries targeting sensitive Active Directory attributes. It correlates both LDAP query events and Windows Security Event ID 4662 to identify bulk access to attributes like 'samAccountName', 'userPassword', and 'memberOf'.
Detects high-volume outbound network scanning activity from a single internal source device. The rule identifies anomalous behavior characterized by rapid connection attempts to a large number of distinct destination IPs and ports, consistent with scanning patterns observed in botnets like JDY, which often target edge network infrastructure (Cisco, Ubiquiti, Draytek).
Detects repeated inbound TCP connection attempts to port 3389 (RDP) from a single source address within a short timeframe. This behavior is indicative of an RDP brute-force or password spraying attack targeting remote desktop services.
The rule identifies potential network scanning or probing activity by detecting a high frequency of network connection attempts (3 or more within a 1-minute window) directed at a specific remote port, 1313. This port is often associated with non-standard services or custom applications and may indicate reconnaissance or unauthorized service discovery.
This rule monitors web server access logs for suspicious activity targeting sensitive Flowise API endpoints (credentials, variables, secretvariable, apikey). It flags two types of threats: 1) Case-bypass evasion attempts, where canonical endpoints are bypassed via non-standard casing while requesting sensitive data (e.g., matching a status 200 on non-canonical casing for sensitive paths), and 2) High-frequency requests indicative of bulk enumeration or directory/wordlist scanning.
Detects execution of common network reconnaissance tools such as nmap, masscan, and zmap, or PowerShell commands that utilize Test-NetConnection for automated port sweeping across a defined range.
This rule detects activities related to the 'ipv6_extlen_wrap_probe' proof-of-concept (PoC) exploit, which targets IPv6 extension header vulnerabilities. The detection logic monitors for: 1. Execution of the PoC binary, 2. Compilation of the PoC source code using common compilers like g++ or MinGW, 3. Creation of files associated with the PoC, and 4. Nmap execution with specific flags indicative of an attempt to trigger the vulnerability via raw IPv6 scanning.
This rule detects activities associated with domain enumeration and discovery. It monitors for the execution of known offensive tools like SharpADWS, network scanners, and specific PowerShell/command-line operations that query Active Directory groups and computers. Additionally, it identifies unauthorized network connections to the Active Directory Web Services (ADWS) port 9389, which can indicate an attacker attempting to interact with the domain environment directly from a compromised host.
Detects bulk enumeration of Microsoft Graph API endpoints (users, groups, devices, service principals) characteristic of tools like AzureHound or roadtx. The detection focuses on high-frequency GET requests originating from known Edge browser client IDs associated with CA policy bypass (CVE-2025-0309) where tokens lack MFA claims, indicating unauthorized reconnaissance in an Azure/Entra ID environment.
Detects a single source IP address initiating Remote Desktop Protocol (Logon Type 10) connections to three or more distinct computer destinations within a 10-minute window. This behavior is indicative of lateral movement or internal network scanning activity.
Detects high-velocity port scanning bursts from a single source IP address targeting multiple destinations, often indicative of botnet reconnaissance activity such as the JDY botnet used to identify edge devices vulnerable to specific exploits like CVE-2026-35616.
Detects high frequency inbound network connection attempts or accepted connections initiated by common file sharing processes (e.g., NearShare.exe, NearbySharing.exe, quickshare.exe, sharingd, airplayd). A high volume of inbound connection attempts may indicate brute force, discovery, or malicious scanning behavior using legitimate file sharing tools as a conduit.
This rule detects suspicious network connections originating from internal IP addresses to common service ports (DNS, SMB, RDP, WinRM) on remote, non-internal IP addresses. It flags instances where a single process on a device makes 10 or more such connections within an hour, which could indicate reconnaissance, lateral movement, or data exfiltration attempts.
Detects anomalous network scanning behavior from a Qualys scanner towards Domain Controller ports. The rule monitors CommonSecurityLog and NetworkSessions for high volumes of connection attempts (more than 50 within one hour) targeting critical Active Directory ports (88, 135, 389, 445, 636, 3268, 3269). This activity may indicate a scanner configuration error, a compromised scanner, or an adversary attempting to map the environment while masquerading as a security tool.
Detects the use of 'netsh trace' to capture network traffic, often associated with reconnaissance activity by threat actors like The Gentlemen RaaS. The rule monitors for command patterns involving trace start/stop, interface show, and specific configuration flags like 'capture=yes', 'report=no', 'filemode=circular', or output to 'ADMIN$' shares.
Page 13 of 32