Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
58 detections
Filters
Last updated
All Time
Detection languages
29
19
4
3
3
Contributors
9
9
9
8
8
Categories
40
15
11
11
8
Platforms
41
22
5
3
2
Products / Services
21
21
11
10
7
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
CVEs
1
IDS Classtypes
13
6
IDS Protocols
18
1
Webworm Executes Nuclei and dirsearch
Cortex XDR
Detects vulnerability and directory scanners (Nuclei, dirsearch, or Python scripts) launched with output files or target lists covering numerous web servers. This activity is associated with the Webworm threat group.
Detects high-frequency port scanning activity from external, non-private IP addresses targeting common network services. The rule identifies different scanning profiles, including wide port sweeps and targeted multi-port scans, which are consistent with reconnaissance behaviors observed in botnet activity like the KV/JDY clusters.
This rule detects network connections to common IP geolocation services such as ip-api.com, ipinfo.io, ipgeolocation.io, and bgpview.io. Adversaries may use these services to gather information about the victim's network, including IP addresses, geographical location, and network topology, which can aid in further targeting or reconnaissance efforts.
Detects Advanced IP Scanner executing from common temporary or program data directories, which is often observed in post-exploitation scenarios. This tool is frequently used by adversaries for network reconnaissance.
This rule detects unusual network connection patterns characterized by a high volume of connections to a remote IP address within a 5-minute window, combined with anomalous connection durations. Specifically, it flags scenarios where there are more than 1000 connections and either the 95th percentile of connection durations is very short (less than 50ms) or the 5th percentile of connection durations is very long (greater than 30000ms). These patterns can indicate activities such as network scanning, denial-of-service attempts, or command and control communication.
Detects an unusually high volume of web requests (1000 or more per minute) originating from a single IP address to an IIS web server. This pattern can indicate various malicious activities such as brute-force attacks, denial-of-service (DoS) attempts, or aggressive web scanning.
This rule detects potential network reconnaissance activity by looking for keywords such as 'scan', 'sweep', 'probe', 'recon', 'nmap', and 'nessus' within the 'Message' field of CommonSecurityLog entries. This could indicate an adversary actively gathering information about the network infrastructure.
This rule detects an unusual number of HTTP OPTIONS or TRACE method requests from a single IP address within a one-hour window. While these methods have legitimate uses, their frequent or excessive use can indicate reconnaissance, vulnerability scanning, or attempts to bypass security controls. The rule triggers if 5 or more such requests are observed from the same IP within an hour.
Stealth NULL Scan Port Probe
Suricata
This rule detects a Stealth NULL Scan Port Probe. A NULL scan is a type of port scan where all the TCP flags (URG, ACK, PSH, RST, SYN, FIN) are turned off. If the target port is closed, the target system should respond with an RST packet. If the port is open, the target system should not respond at all. This behavior can be used by attackers to map out open ports on a system while attempting to evade detection by some firewalls or intrusion detection systems that might be configured to only look for SYN packets.
Stealth FIN Scan Port Probe
Suricata
This rule detects a stealth FIN scan port probe. A FIN scan is a type of port scan that sends TCP segments with only the FIN flag set. If the target port is closed, it should respond with an RST segment. If the port is open, it should ignore the FIN segment. This rule triggers if 10 such FIN packets are observed from a single source within a 30-second window, indicating a potential port scan attempt.
Stealth XMAS Scan Port Probe
Suricata
This rule detects a Stealth XMAS Scan Port Probe. An XMAS scan is a type of port scan where the FIN, PSH, and URG flags are set in the TCP header. This type of scan attempts to determine if a port is open by exploiting the TCP RFC 793. If a port is closed, the target system should respond with an RST packet. If the port is open, no response is expected. The rule specifically looks for TCP packets with the FPU (FIN, PSH, URG) flags set, originating from any source IP and port, destined for any IP on the local network ($HOME_NET) on any port. A threshold is applied to trigger an alert if 10 such packets are observed from the same source within a 30-second window, indicating a scanning activity.
This rule detects an active IP block scan by monitoring TCP SYN packets. It triggers an alert if more than 100 SYN packets are observed from a single source IP address within a 10-second window, indicating a potential reconnaissance activity where an attacker is scanning a range of IP addresses to identify live hosts or open ports.
Detects possible TCP SYN port scanning activity by identifying a high volume of SYN packets from a single source within a short time window, which is commonly associated with reconnaissance tools like Nmap.
High Port Range Scan Detected
Suricata
This rule detects a high port range scan by monitoring TCP connections with the SYN flag set (indicating a new connection attempt) to ports within the high range (1025-65535) on the home network. It triggers an alert if more than 200 such connection attempts are observed from a single source IP address within a 10-second window.
Stealth TCP SYN Scan Detected
Suricata
Detects low-and-slow TCP SYN scanning activity where an attacker reduces scan rate to avoid basic threshold detection. This is common in stealth reconnaissance using Nmap or custom scanners.
This rule detects a full privileged port range scan. It triggers an alert if a source IP sends 200 TCP SYN packets to ports 0-1024 on the home network within a 10-second window. This behavior is indicative of an attacker attempting to discover open services on well-known ports.
This rule detects unusual network connection patterns characterized by a high volume of connections to a remote IP address within a 5-minute window, combined with anomalous connection durations. Specifically, it flags scenarios where there are more than 1000 connections and either the 95th percentile of connection durations is very short (less than 50ms) or the 5th percentile of connection durations is very long (greater than 30000ms). These patterns can indicate activities such as network scanning, denial-of-service attempts, or command and control communication.
This rule detects potential network reconnaissance activity by looking for keywords such as 'scan', 'sweep', 'probe', 'recon', 'nmap', and 'nessus' within the 'Message' field of CommonSecurityLog entries. This could indicate an adversary actively gathering information about the network infrastructure.
Detects inbound network connections and Azure AD sign-in attempts originating from the 21-IP RDP scanning fleet attributed to AS213438 (ColocaTel Inc., Seychelles), as reported by GreyNoise on April 10, 2026. The fleet generated 67.4% of global RDP Crawler activity on April 7, 2026 across four /24 blocks geolocated to the Netherlands. The same ASN demonstrated a burst-and-crash pattern in both March and April 2026, suggesting further rotations are likely.
Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string and performs GET requests. This activity is indicative of reconnaissance or data scraping.
This rule identifies a source IP address that is triggering a variety of Akamai WAF rules across multiple hosts, which is indicative of broad scanning or reconnaissance activity. It aggregates events by source IP within 30-minute windows, counting distinct WAF rules and hosts targeted. The rule then applies thresholds to identify suspicious behavior, specifically looking for an IP that triggers more than 5 distinct WAF rules, targets more than 2 distinct hosts, and generates over 10 denied events.
Page 2 of 3