Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
329 detections
Filters
Last updated
All Time
Detection languages
145
74
28
25
16
Contributors
68
49
47
30
19
Categories
222
208
37
27
26
Platforms
271
76
33
18
4
Products / Services
91
82
44
23
23
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
CVEs
2
2
1
1
1
IDS Classtypes
8
2
IDS Protocols
4
4
1
1
Detects the MrAgent binary, a deployment tool used in RansomHouse operations to manage compromised ESXi hosts and deploy the 'Mario' encryptor.
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
Detects potential exploitation of Oracle E-Business Suite vulnerability CVE-2025-61882, which allows for unauthenticated remote code execution. This rule looks for specific web request URIs, post-exploitation process activity, and known indicators of compromise (IOCs).
Behavior is tied to enumeration of network services, relating to the discovery tactic.
Where "network_connection_discovery`"is a lookup table of “ifconfig.me” and related services
Where "network_connection_discovery`"is a lookup table of “ifconfig.me” and related services
Detects queries to IP lookup services used by FlexibleFerret for victim identification.
Detects potential Dtrack RAT activity by identifying specific command-line patterns associated with network discovery and system information gathering. The rule looks for the execution of 'ping' with specific arguments, 'ipconfig /all' redirecting output to a temporary file, and 'netsh interface ip show config' also redirecting output to a temporary file. These commands are commonly used by Dtrack for reconnaissance.
This rule detects the execution of common Windows command-line utilities used for system network configuration discovery. Adversaries often use these commands to gather information about the network environment, including IP addresses, network interfaces, ARP tables, NetBIOS information, and routing tables. The specific commands monitored are 'ipconfig /all', 'netsh interface show interface', 'arp -a', 'nbtstat -n', 'net config', and 'route print'.
This rule detects suspicious child processes spawned by 'msra.exe' (Microsoft Remote Assistance). Adversaries have been observed using msra.exe for process injection, discovery, and persistence. The rule specifically looks for common command-line utilities being executed as child processes of msra.exe, which could indicate malicious activity.
Detects potential remote code execution associated with the exploitation of Oracle E-Business Suite vulnerability CVE-2025-61882 on Windows hosts. The rule looks for a Java process spawning a command shell to execute reconnaissance commands, followed by an outbound network connection from the same Java process within a short time frame. This behavior is consistent with post-exploitation activity observed in the campaign.
The following analytic detects a suspicious modification to the firewall to allow network discovery on a machine. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving the 'netsh' command to enable network discovery. This activity is significant because it is commonly used by ransomware, such as REvil and RedDot, to discover and compromise additional machines on the network. If confirmed malicious, this could lead to widespread file encryption across multiple hosts, significantly amplifying the impact of the ransomware attack.
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
This rule detects the execution of 'netsh.exe' with command-line arguments indicating an attempt to discover firewall configurations. Specifically, it looks for 'netsh' combined with 'show firewall' and additional keywords like 'config', 'state', or 'rule', or 'name=all'. This activity is often performed by adversaries to understand the network environment and identify potential egress points or defensive measures.
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
Detects the initial PowerShell download cradle associated with ClickFix/CORNFLAKE.V3 campaigns. This activity is often the result of a user being tricked into pasting and running a command from a malicious website.
This analytic identifies non-browser processes reaching out to public IP lookup or geolocation services. These services are commonly used by legitimate tools, but their usage outside of browsers may indicate network reconnaissance, virtual machine detection, or staging by malware. This activity is observed in post-exploitation frameworks, stealer malware, and advanced threat actor campaigns. The detection relies on Cisco Network Visibility Module (NVM) telemetry and excludes known browser processes to reduce noise.
Detects scenarios where an attacker enumerates scheduled task configuration.
Detects scenarios where an attacker attempts to exploit DNS server missconfiguration to trigger a DNS zone transfer and enumerate list of valid IP and hostnames.
Detects scenarios where an attacker attempts to extract current Windows firewall configuration to prepare an attack.
Detects Blacklotus HTTP downloader injection into winlogon.exe process.
Detects network requests to common IP geolocation services, such as 'ip-api.com/json'. This is a known anti-analysis technique used by malware, including a loader associated with the Silver Fox APT group, to determine if it is running in a research or sandbox environment by checking the public IP address, ISP, and organization.
The following analytic detects the execution of Windows Management Instrumentation Command-line (WMIC) commands used for network interface discovery on a Windows system. Specifically, it identifies commands such as “wmic nic” that retrieve detailed information about the network adapters installed on the device. While these commands are commonly used by IT administrators for legitimate network inventory and diagnostics, they can also be leveraged by malicious actors for reconnaissance, enabling them to map network configurations and identify potential targets. Monitoring WMIC network interface queries allows security teams to detect suspicious or unauthorized enumeration activities, supporting early threat identification and response.
Page 12 of 16