Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
653 detections
Filters
Last updated
All Time
Detection languages
268
245
33
31
27
Contributors
207
128
118
98
20
Categories
20,456
11,839
5,876
5,155
4,865
653
Platforms
430
207
97
32
29
Products / Services
270
154
77
73
39
MITRE Techniques
326
308
201
105
97
CVEs
5
2
2
1
1
IDS Classtypes
177
67
11
9
3
IDS Protocols
129
108
16
7
3
This detection identifies potential usage of the Naabu port scanner by searching for its process execution or its specific network user-agent string. Naabu is a fast port scanner that can be used for network reconnaissance. This search leverages the Endpoint and Web CIM data models.
Detects a loop attempting 'net use' against multiple IPC$ shares and recording reachable SMB hosts. This activity is indicative of network reconnaissance, specifically looking for accessible shares on remote systems within a subnet.
Identifies the execution of portable network scanning utilities (netscan.exe, advanced_ip_scanner.exe) that also initiate network connections to common administrative ports (135, 445, 3389). This activity is often observed post-breach to map the internal network.
Detects automated scraping of company location and headquarters pages
Detects the execution of known network scanning utilities (nmap, masscan, portscan) or suspicious command line arguments often associated with network reconnaissance activities.
Detects the execution of known network scanning utilities (nmap, masscan, portscan) or suspicious command line arguments often associated with network reconnaissance activities.
Detects execution of 'netstat.exe' with specific flags ('-a', '-n', '-o', or '-b') initiated by command-line interpreters like cmd.exe, powershell.exe, wscript.exe, or cscript.exe. These flags are commonly used for network reconnaissance and discovery of active TCP connections, listening ports, and associated process IDs.
Detects network scanning activity originating from processes side-loaded with Backdoor.Turn, specifically looking for 'dbgview64.exe' initiating connections to a large number of unique remote IPs.
Detects anomalous network scanning behavior from a Qualys scanner towards Domain Controller ports. The rule monitors CommonSecurityLog and NetworkSessions for high volumes of connection attempts (more than 50 within one hour) targeting critical Active Directory ports (88, 135, 389, 445, 636, 3268, 3269). This activity may indicate a scanner configuration error, a compromised scanner, or an adversary attempting to map the environment while masquerading as a security tool.
Detects high-volume, multi-port connections from a single source to a domain controller, which is indicative of vulnerability scanning activity such as Nessus. The rule monitors for a large volume of connection attempts across multiple sensitive ports (e.g., 88, 135, 389, 445, 464, 636, 3268, 3269) within a short 5-minute window.
This rule detects high-volume connection requests to LDAP services (default ports 389, 636, 3268, 3269). A high number of connections from a single source to a destination within a short time window may indicate automated reconnaissance, LDAP enumeration, or brute-force attempts against domain services.
Detects high-frequency network connection attempts targeting common ManageEngine service ports (8443, 9251, 9261, 8080). This behavior is indicative of potential network reconnaissance, service scanning, or automated exploitation attempts.
Detects high-frequency network connection attempts targeting common ManageEngine service ports (8443, 9251, 9261, 8080). This behavior is indicative of potential network reconnaissance, service scanning, or automated exploitation attempts.
Detects workstations establishing multiple connections to non-standard, internal management ports (SSH, Telnet, SNMP). This behavior is often associated with lateral movement or unauthorized network scanning using tools that leverage management protocols.
Identifies the encryptor rapidly scanning the local subnet on Port 445 (SMB) to locate neighboring hosts for propagation. This rule specifically looks for a single device initiating network connections to more than 20 unique IP addresses on port 445 within a one-minute window.
Scripted Ping Sweep Detection
Cortex XDR
Detects a command loop executing a ping sweep across an entire subnet and writing responsive hosts to 'alive_hosts.txt'. This activity is indicative of network reconnaissance.
Detects one external source repeatedly requesting PeopleSoft administrative endpoints across multiple destinations or URLs within fifteen minutes. This activity could indicate an attacker performing reconnaissance or vulnerability scanning against public-facing PeopleSoft applications.
This rule monitors network device telemetry for three distinct indicators of compromise: usage of specific botnet-associated User-Agent strings, high-volume automated scanning against known IoT-vulnerable ports (80, 8080, 7547, 52869, 37215), and outbound network connections to known RondoDox command and control server infrastructure.
This detection identifies potential usage of the Naabu port scanner by searching for its process execution or its specific network user-agent string. Naabu is a fast port scanner that can be used for network reconnaissance. This search leverages the Endpoint and Web CIM data models.
Tracks python executing loop structures scanning internal class C subnets on standard lateral movement ports (135, 445, 3389). The rule identifies devices where python.exe initiates network connections to more than 15 unique remote IPs on these ports within a one-minute interval.
Correlates the execution of an agent with rapid outbound connections to Port 445 across internal subnets, indicating SMB lateral movement or scanning activity.
Page 17 of 32