Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
653 detections
Filters
Last updated
All Time
Detection languages
268
245
33
31
27
Contributors
207
128
118
98
20
Categories
20,456
11,839
5,876
5,155
4,865
653
Platforms
430
207
97
32
29
Products / Services
270
154
77
73
39
MITRE Techniques
326
308
201
105
97
CVEs
5
2
2
1
1
IDS Classtypes
177
67
11
9
3
IDS Protocols
129
108
16
7
3
Detects known vulnerability scanner user agents such as Nmap, Nikto, Nessus, Burp
This rule monitors for the execution of common reconnaissance, enumeration, and scanning tools often used in post-exploitation scenarios. It detects the usage of scanners like fscan, network discovery utilities like net.exe, nltest, dsquery, and credential/directory enumeration tools like SharpHound. These tools are commonly used for domain discovery, network mapping, and collecting information for lateral movement or privilege escalation.
Detects Grixba infostealer activity associated with the Play Ransomware group. The rule monitors for network host and share enumeration using net.exe and WMIC, and tracks the execution of the Grixba binary GT_NET.exe from the non-standard path C:\Users\Public\Music\.
Detects the execution of unauthorized network scanning tools (e.g., netscan.exe, n.exe), usage of reconnaissance PowerShell scripts like Invoke-ShareFinder, or the creation of common reconnaissance artifacts such as 'delete.me' or 'shares.txt'. The rule monitors Sysmon process creation, network connection events, and file creation events to identify activities consistent with internal network discovery and lateral movement preparation.
Detects malicious network discovery and enumeration activities associated with Akira ransomware. This includes the execution of SoftPerfect Network Scanner (netscan.exe) for port/service scanning and the use of the PowerView Invoke-ShareFinder module for identifying accessible network shares, often observed in post-compromise intrusion phases.
Detects anomalous high-rate outbound network scanning activity (targeting numerous distinct destination IPs and ports) originating from internal SOHO or edge devices (e.g., Cisco, Ubiquiti, Draytek hardware). This pattern is consistent with compromised devices acting as nodes within a botnet, such as the JDY cluster, conducting reconnaissance.
Detects execution of 'netstat.exe' with specific flags ('-a', '-n', '-o', or '-b') initiated by command-line interpreters like cmd.exe, powershell.exe, wscript.exe, or cscript.exe. These flags are commonly used for network reconnaissance and discovery of active TCP connections, listening ports, and associated process IDs.
This rule detects anomalous spikes in inbound network connections to common edge device management ports (80, 443, 8080, 8443) by baselining the number of unique source IP addresses per destination over a 30-day window. It triggers an alert when the hourly count of unique source IPs deviates significantly (greater than 3 standard deviations) from the historical mean, which may indicate active network scanning or brute-force attempts.
Detects high-volume, multi-port connections from a single source to a domain controller, which is indicative of vulnerability scanning activity such as Nessus. The rule monitors for a large volume of connection attempts across multiple sensitive ports (e.g., 88, 135, 389, 445, 464, 636, 3268, 3269) within a short 5-minute window.
Detects potential reconnaissance activities directed at a domain controller, specifically monitoring for DNS zone transfer (AXFR) requests or unusually high volumes of DNS 'ANY' queries. These behaviors are often associated with adversaries attempting to map network infrastructure or discover internal resources.
This rule detects high-volume connection requests to LDAP services (default ports 389, 636, 3268, 3269). A high number of connections from a single source to a destination within a short time window may indicate automated reconnaissance, LDAP enumeration, or brute-force attempts against domain services.
This rule monitors network traffic over the Telnet protocol (TCP port 23) for patterns indicative of Mirai botnet propagation. It identifies sequences of characters commonly used in Mirai brute-force attempts to guess default credentials (e.g., 'admin' followed by 'password'). The rule utilizes a threshold-based detection filter to trigger only when multiple such attempts are observed from a single source within a 60-second window, helping to filter out individual noise and focus on active scanning behavior.
This rule detects potential vulnerability scanning activity by identifying devices making multiple successful network connections to specific ports commonly used by vulnerability scanners (8834, 8889, 1241). A device is flagged if it makes 3 or more such connections within a one-hour window.
Detects workstations establishing multiple connections to non-standard, internal management ports (SSH, Telnet, SNMP). This behavior is often associated with lateral movement or unauthorized network scanning using tools that leverage management protocols.
Detects potential internal network scanning activity by identifying devices attempting connections to 5 or more distinct sensitive ports within a one-hour window. This behavior is indicative of reconnaissance activities aimed at identifying vulnerable services such as SSH, SMB, RDP, or various database management systems.
This rule detects rapid scanning of local network subnets on SMB (port 445) and RDP (port 3389) by a single process on a device. It identifies instances where a process initiates connections to more than 20 unique local IP addresses within a one-minute window, which could indicate an attempt by ransomware, such as Nightspire, to identify adjacent victims for propagation prior to local encryption.
Detects the execution of the AdaptixC2 agent (AdgNsy.exe) from AppData\Local directories and its subsequent internal network scanning activity against sensitive ports (445, 3389, 5985). The rule also monitors for potential dropper patterns associated with the Bumblebee loader, specifically involving processes like consent.exe or msiexec.exe dropping the binary.
Detects a suspicious sequence of adversary behaviors typically associated with pre-ransomware activity. The rule identifies high-volume SMB scanning (more than 20 unique IPs in 5 minutes) correlated with network share discovery (using tools like netscan.exe or PowerShell scripts such as Invoke-ShareFinder), and optionally links these actions to credential dumping events on the same host (LSASS dumping via comsvcs.dll or NTDS.dit exfiltration via wbadmin) within a 48-hour window.
Detects the execution of 'AdgNsy.exe', a known malicious masquerading process associated with the AdaptixC2 beacon, attempting to scan internal network infrastructure by initiating outbound connections to sensitive ports including SMB (445), RDP (3389), LDAP (389/636), and 9401. This behavior indicates internal reconnaissance for lateral movement.
This rule detects mass scanning activity targeting FortiGate SSL VPN login endpoints on non-standard HTTPS ports (4433, 4443, 8443, 9443, 10443, 541). It specifically looks for HTTP requests containing '/login' in the URI, indicating an attempt to find or interact with the VPN login page. The rule uses a threshold to identify mass scanning, triggering an alert if a source IP makes 10 or more such requests within 60 seconds.
Detects indicators associated with the JDY botnet targeting SOHO and IoT infrastructure. The rule monitors for suspicious firmware update attempts to non-vendor hosts, identifies high-rate outbound scanning from edge devices, and flags devices that show re-emergence of suspicious behavior after a quiet period.
Page 14 of 32