Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
188 detections
Filters
Last updated
All Time
Detection languages
154
11
11
7
3
Contributors
47
34
22
16
9
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
100
58
51
32
23
Products / Services
72
20
19
13
12
MITRE Techniques
86
71
56
52
33
CVEs
5
5
5
4
4
IDS Classtypes
7
4
IDS Protocols
10
1
This rule detects potential vulnerability scanning activity by identifying devices making multiple successful network connections to specific ports commonly used by vulnerability scanners (8834, 8889, 1241). A device is flagged if it makes 3 or more such connections within a one-hour window.
Detects the creation of files containing keywords such as 'vulnerability', 'assessment', or 'scan'. This rule aims to identify activities related to vulnerability scanning or security assessments being performed on a system, potentially indicating reconnaissance or unauthorized activity. The events are summarized by the initiating process account name and time to help identify the source of these activities.
This rule detects network reconnaissance activity by identifying HTTP user-agent strings commonly associated with vulnerability scanners like Nmap or Masscan. It specifically looks for the string 'Nmap' within the HTTP user-agent header in traffic flowing from the internal network to a server.
This rule identifies 'chokepoint' devices within an environment based on their high number of inbound and outbound connections (at least 2 each). It then enriches these chokepoint devices with vulnerability and misconfiguration remediation recommendations from Microsoft Defender for Endpoint (MDE) TVM and Exposure Graph. The rule prioritizes remediation based on the calculated 'ChokepointScore' (InboundCount * OutboundCount) and indicates if the device has active exploits. This helps security teams focus remediation efforts on critical assets that could significantly impact the network if compromised.
CVE-2026-0300 Scanner Tool User-Agent
Cortex XDR
Detects the use of the CVE-2026-0300 scanner tool by its distinct User-Agent string attempting to identify vulnerable PAN-OS Captive Portals.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32631
This rule detects potential network reconnaissance activity by looking for keywords such as 'scan', 'sweep', 'probe', 'recon', 'nmap', and 'nessus' within the 'Message' field of CommonSecurityLog entries. This could indicate an adversary actively gathering information about the network infrastructure.
Packet Inspection of the exploitation of the adobe zero day vulnerability through CommonSecurityLog.
Due to the fact that CSL usually does not populate all the fields, many conditions come with IsEmpty(cond), but you can comment that if too broad.
Due to the fact that CSL usually does not populate all the fields, many conditions come with IsEmpty(cond), but you can comment that if too broad.
This rule detects the presence of newly exposed risky web components, such as administrative panels or development tools, that have been discovered by Microsoft Defender External Attack Surface Management (EASM). The rule identifies components from a predefined list of 'risky_components' that have been seen for the first time within the last 7 days, indicating a recent exposure that could increase the attack surface.
This rule identifies Azure Arc-enabled machines running agent versions older than 1.61, which are potentially vulnerable to CVE-2026-26117. It queries Azure Activity logs to extract agent versions and flags machines with outdated agents.
Detects User-Agent rotation behavior from a single Source IP (c-ip) associated with more than 3 distinct
User-Agent (c-useragent) values within a 5-minute window. This behavior is characteristic of the Nuclei
'-random-agent' flag, which allows the scanner to bypass WAF (Web Application Firewall) detections by
using a different, valid browser User-Agent string for each request.
User-Agent (c-useragent) values within a 5-minute window. This behavior is characteristic of the Nuclei
'-random-agent' flag, which allows the scanner to bypass WAF (Web Application Firewall) detections by
using a different, valid browser User-Agent string for each request.
This rule identifies devices running vulnerable versions of Notepad++. It parses the software version to determine if it is older than 8.9.1, which was identified as vulnerable in a security incident. The rule specifically looks for Notepad++ installations and flags any instances where the major version is less than 8, or if the major version is 8 and the minor version is less than 9, or if the major version is 8, the minor version is 9, and the patch version is less than 1.
KQL Query
This rule detects sign-in attempts to Azure Active Directory (AAD) service principals where the User-Agent string contains "TruffleHog". TruffleHog is an open-source tool used for finding sensitive data (like credentials) in various data sources. Its presence in AAD sign-in logs, especially for service principals, could indicate an attempt to scan for or verify leaked secrets or credentials associated with service accounts.
This query identifies devices with specific versions of installed software that are considered vulnerable. It is a template that can be easily adapted to track any software by changing the placeholder variables. It enriches the findings with device and user information for easier investigation.
Detects MongoDB instances with a vulnerable configuration where 'zlib' is enabled for network message compression. This configuration makes the server vulnerable to MongoBleed (CVE-2025-14847).
This rule detects the usage of default credentials on assets by correlating vulnerability scan results from Qualys. Specifically, it looks for a predefined list of Qualys vulnerability IDs (QIDs) that indicate the presence of default credentials. The rule aims to identify systems that have not had their default passwords changed, which is a critical security hygiene practice.
This rule detects hosts that are identified by a Qualys vulnerability scan as not having a firewall product detected. This indicates a compliance issue where a host is not protected by a firewall, potentially exposing it to unauthorized access or attacks. The alert signifies non-compliance with security policies.
Detects potential exploitation of the TARmageddon vulnerability (CVE-2025-62518) by identifying multiple writes to sensitive configuration files by the same process in a short time frame. This behavior can indicate a file overwrite attack where a malicious TAR archive smuggles and extracts a secondary file to hijack build processes or application configurations.
This advanced hunting query detects CISA Alert (AA22-117A) 2021 Top Routinely Exploited Vulnerabilities https://www.cisa.gov/uscert/ncas/alerts/aa22-117a
This query identifies Linux devices with vulnerable versions of the Common Unix Printing System (CUPS) installed, which are susceptible to remote denial-of-service and authentication bypass attacks as described in CVE-2025-58364 and CVE-2025-58060. The rule filters for CUPS software packages on Linux systems and compares the installed version against a known vulnerable version cutoff. This cutoff is a placeholder and must be updated with specific version information from official vendor advisories.
Page 6 of 9