Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
653 detections
Filters
Last updated
All Time
Detection languages
268
245
33
31
27
Contributors
207
128
118
98
20
Categories
20,456
11,839
5,876
5,155
4,865
653
Platforms
430
207
97
32
29
Products / Services
270
154
77
73
39
MITRE Techniques
326
308
201
105
97
CVEs
5
2
2
1
1
IDS Classtypes
177
67
11
9
3
IDS Protocols
129
108
16
7
3
This rule monitors network device logs for patterns indicative of reconnaissance or vulnerability scanning against management and VPN interfaces of common firewall and network appliances (FortiGate, Meraki, WatchGuard, Sophos). It flags sources that either request multiple sensitive paths related to system status and configuration or employ known scanning tools (Nmap, masscan, Nuclei, zgrab, curl) in the user-agent string.
This rule monitors network device logs for patterns indicative of reconnaissance or vulnerability scanning against management and VPN interfaces of common firewall and network appliances (FortiGate, Meraki, WatchGuard, Sophos). It flags sources that either request multiple sensitive paths related to system status and configuration or employ known scanning tools (Nmap, masscan, Nuclei, zgrab, curl) in the user-agent string.
This rule detects anomalous, high-frequency unauthenticated POST requests targeting NetScaler ADC and Gateway management or service endpoints (/vpn/, /logon/, /nitro/). Such patterns are characteristic of automated reconnaissance and exploitation attempts, specifically targeting vulnerabilities like CVE-2026-88771 and CVE-2026-88772.
This rule monitors for a rapid sequence of TCP SYN packets directed towards common administrative ports (SSH/22, RDP/3389, SMB/445) within a short window, indicative of an automated lateral movement scanning attempt or a brute-force discovery phase originating from within the internal network.
Detects repeated attempts to perform IIS 8.3 tilde short-filename enumeration. This reconnaissance technique exploits the legacy DOS 8.3 file naming convention to identify the existence and naming of files or directories on a Microsoft IIS web server.
This rule detects potentially compromised accounts by correlating risky Entra ID sign-ins to Citrix NetScaler with subsequent VPN session establishment followed by rapid, high-volume outbound connection activity from the source IP address. This pattern is indicative of a threat actor using compromised credentials to gain access via VPN and immediately perform internal network scanning or data staging.
Detects behavioral patterns associated with the Everest ransomware loader, specifically the execution of a .NET host process from a non-standard parent, potentially indicating process injection, combined with network activity indicative of lateral movement or discovery, such as Wake-on-LAN packets or SMB scanning.
Detects a single source IP initiating network connections to 50 or more distinct destination ports within a 60-second window, which is indicative of an automated port scanning sweep. The rule correlates individual connection events while excluding pre-defined allowlisted vulnerability scanners.
Detects a suspicious sequence of events where a host performs multiple reconnaissance-style probes (health checks, documentation, or OpenAPI definitions) followed within 10 minutes by access to sensitive artifact-related URLs on the same remote host. This pattern is indicative of an attacker profiling a target server for metadata and then proceeding to exfiltrate files or sensitive artifacts.
Detects an suspicious progression of activities originating from identified AI assistant/agent processes. The rule monitors for a chain of behaviors occurring within a 15-minute window: execution of an AI agent/tool, followed by host discovery (network/system enumeration), access to sensitive local credential files, archival of data, and outbound network communication to common file-sharing/exfiltration platforms.
This rule detects potentially compromised accounts by correlating risky Entra ID sign-ins to Citrix NetScaler with subsequent VPN session establishment followed by rapid, high-volume outbound connection activity from the source IP address. This pattern is indicative of a threat actor using compromised credentials to gain access via VPN and immediately perform internal network scanning or data staging.
Detects a single host or account generating a high volume of LDAP queries (typical of reconnaissance tools like BloodHound/SharpHound) within a 10-minute time window. The rule specifically looks for more than 500 LDAP queries targeted at a limited number of Domain Controllers.
Detects high-frequency access requests directed at authentication or API endpoints originating from known Tor exit-node IP addresses. This activity is indicative of credential stuffing or automated scanning patterns that attempt to evade IP-based reputation or rate-limiting filters.
Detects high-volume web crawling or reconnaissance activities originating from autonomous AI agent frameworks, such as AutoGPT, BabyAGI, LangChain, or CrewAI. These activities are identified by analyzing User-Agent strings and applying threshold-based rate limiting to identify potential automated reconnaissance patterns.
Detects HTTP requests where the User-Agent header matches known strings associated with AI-powered penetration testing or reconnaissance agents, such as PentestGPT, AutoGPT, or AI-Recon tools.
Detects high-volume account enumeration activity associated with the TeamFiltration tool, characterized by the use of legacy Microsoft Teams desktop client User-Agent strings (specific versions of Teams, Electron, and Chrome) within a short time window.
Detects an abnormally high volume of unique DNS subdomain queries originating from a single source IP address within a short time window. This behavior is often indicative of automated reconnaissance techniques, such as subdomain brute-forcing or dictionary attacks, used to discover infrastructure or hidden services.
Detects anomalous outbound lateral movement attempts where a single source host initiates WinRM connections (ports 5985/5986) to an unusually high number of distinct destination hosts within a short timeframe, which is often indicative of automated credential propagation or internal scanning by an adversary.
This rule monitors firewall logs for internal RDP (port 3389) connection attempts from a single source host to multiple destination hosts within internal address ranges. This pattern of sequential connectivity is often indicative of automated internal reconnaissance or lateral movement scanning using RDP.
Detects web requests targeting sensitive Jenkins/CI-CD administrative and build-triggering endpoints, such as /script, /manage, and /job/*/build. These paths are high-value targets for reconnaissance and automated exploitation efforts. This rule identifies potentially malicious activity by monitoring for access to these specific paths, which should be correlated with frequency and source data to differentiate automated scanning from authorized administrative or system activities.
Detects high-frequency requests from automated scripting tools like 'python-requests', 'aiohttp', or 'Scrapy' targeting sensitive directories or files often associated with administrative panels or application configurations (e.g., admin, .env, wp-admin). The rule triggers when a threshold of 10 requests is reached within a 60-second window, indicating potential automated vulnerability or information gathering activity.
Page 3 of 32