Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
653 detections
Filters
Last updated
All Time
Detection languages
268
245
33
31
27
Contributors
207
128
118
98
20
Categories
20,456
11,839
5,876
5,155
4,865
653
Platforms
430
207
97
32
29
Products / Services
270
154
77
73
39
MITRE Techniques
326
308
201
105
97
CVEs
5
2
2
1
1
IDS Classtypes
177
67
11
9
3
IDS Protocols
129
108
16
7
3
Detects high-volume outbound network connection attempts from internal endpoints targeting a specific set of common SOHO/IoT management and service ports. This behavior is consistent with automated service enumeration, banner grabbing, and reconnaissance activity often associated with botnets like the JDY cluster, which target edge devices for potential exploitation.
Detects high frequency inbound network connection attempts or accepted connections initiated by common file sharing processes (e.g., NearShare.exe, NearbySharing.exe, quickshare.exe, sharingd, airplayd). A high volume of inbound connection attempts may indicate brute force, discovery, or malicious scanning behavior using legitimate file sharing tools as a conduit.
Detects high-cardinality, multi-protocol network scanning behavior characteristic of the JDY botnet. The rule identifies internal hosts attempting to connect to a high volume of unique external destinations across multiple protocols with low average bytes per connection, indicative of automated discovery or probing activity.
Detects anomalous network scanning behavior originating from internal hosts. The rule triggers when a host contacts a high number of distinct ports (greater than 50) or establishes a large number of connections (greater than 100) to a high number of distinct IP addresses (greater than 20), excluding common internal network segments. This behavior is indicative of network reconnaissance or service discovery activities typical of an adversary mapping the network.
This rule detects internal hosts initiating connections to known Tor ORPort or DirPort services, indicating potential C2 check-in, correlated with high-rate scanning behavior from the same source IP. This combination suggests a compromised host using an anonymity network for C2 communication while simultaneously performing internal reconnaissance.
This rule monitors network traffic over the Telnet protocol (TCP port 23) for patterns indicative of Mirai botnet propagation. It identifies sequences of characters commonly used in Mirai brute-force attempts to guess default credentials (e.g., 'admin' followed by 'password'). The rule utilizes a threshold-based detection filter to trigger only when multiple such attempts are observed from a single source within a 60-second window, helping to filter out individual noise and focus on active scanning behavior.
Detects high-frequency TCP SYN scanning behavior targeting Telnet (port 23) and SSH (port 22) ports, characteristic of Mirai botnet propagation and reconnaissance activities.
Detects repeated inbound TCP connection attempts to port 3389 (RDP) from a single source address within a short timeframe. This behavior is indicative of an RDP brute-force or password spraying attack targeting remote desktop services.
This rule detects an ICMP ping sweep, which is a common technique used for host discovery within a network. It triggers an alert if more than 20 ICMP echo requests (type 8) are observed from a single source IP within a 10-second window, targeting the home network. This behavior is indicative of an attacker attempting to map out active hosts on the network.
Detects the execution of 'fscan', a common command-line tool used by adversaries for network service discovery, port scanning, and vulnerability identification on a target host.
Detects the execution of known StrikeShark post-compromise reconnaissance tools, specifically fscan.exe and searchall.exe, as well as associated administrative commands used for domain group and trust discovery in Windows environments.
This rule detects potential scanning behavior (port or host sweeps) against specific, commonly targeted service ports (e.g., 443, 80, 8080) and correlates it with suspicious HTTP URI path requests associated with common exploit attempts (e.g., OWA, ECP, or management API paths).
Detects the execution of the FScan tool, used by the StrikeShark threat actor for internal network reconnaissance, port scanning, and host discovery. The rule triggers on common binary names associated with FScan and specific command-line arguments indicative of scanning activity, such as CIDR range targeting and port flags, while excluding other known network utilities.
This rule detects potential vulnerability scanning activity by identifying multiple network connection attempts to common vulnerable ports (135, 139, 445) where the remote URL contains keywords like 'vuln' or 'scan'. It aggregates these activities by device and time, flagging devices with 5 or more such connections within an hour.
This rule detects a high volume (50 or more) of HTTP errors (status codes 400 and above) originating from a single client IP address within a 5-minute time window. This behavior can be indicative of various malicious activities such as brute-force attacks, web application vulnerability scanning, or denial-of-service attempts against a web server.
This rule detects a high frequency of successful network connections from a single device to multiple unique destination IP addresses within a one-hour window. The targeted ports (445, 139, 3389, 22, 21) are commonly used for remote administrative access, file transfers, and remote shell services, which are frequently leveraged by adversaries for lateral movement. The threshold of 3 unique targets in an hour may indicate automated scanning or credential brute-forcing activity across the network.
Detects SNMP enumeration using default community strings
This rule detects the execution of known SMB exploitation tools (e.g., Python-based SMBGhost scanners/payloads, Metasploit resource scripts for EternalBlue) and identifies high-fan-out SMB scanning activity or unauthorized SMB connections from non-standard processes to an internal subnet (10.39.x.x).
Correlates an AI/LLM process executing high-volume network scanning against the internal subnet. This rule detects when processes named 'python.exe' or 'node.exe' initiate a high volume of network connections (more than 20 unique IPs within a minute) to internal IP ranges (10.0.0.0/8 or 192.168.0.0/16).
This rule detects network connections on port 21 (FTP) where the remote URL contains keywords indicative of NetWare directory listings or related services (netware, NDS, bindery, ncf). This could indicate an attempt to discover or interact with NetWare services, potentially exploiting vulnerabilities like Squidbleed.
Detects anomalous device network activity involving 5G-specific protocol ports (e.g., GTP-U, SIP). The rule aggregates unique port usage per device over 1-hour intervals to identify potential network reconnaissance, scanning, or unauthorized control plane communication.
Page 15 of 32