Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
25 detections
Filters
Last updated
All Time
Detection languages
11
7
4
1
1
Contributors
8
8
3
2
1
Categories
5
4
4
4
4
Platforms
12
8
5
2
Products / Services
7
4
3
2
2
MITRE Techniques
18,181
15,741
12,668
8,483
6,296
CVEs
1
IDS Classtypes
7
IDS Protocols
4
3
'Example query for SigninLogs showing how to break out packed fields. In this case extending conditional access Policies '
Total Controlled Folder Access events.
Total Controlled Folder Access events.
The analytic detects port security violations on Cisco switches by leveraging logs from Cisco network devices. It specifically looks for events with mnemonics indicating port security violations. This activity is significant because it indicates an unauthorized device attempting to connect to a secured port, potentially bypassing network access controls. If confirmed malicious, this could allow an attacker to gain unauthorized access to the network, leading to data exfiltration, network disruption, or further lateral movement within the environment.
Page 2 of 2