Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
166 detections
Filters
Last updated
All Time
Detection languages
71
40
30
8
7
Contributors
59
31
28
14
7
Categories
45
44
33
31
17
Platforms
125
31
21
14
5
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
56
51
48
41
32
CVEs
10
8
7
7
6
IDS Classtypes
3
2
1
1
IDS Protocols
6
This rule identifies suspicious command-line activity indicative of log manipulation, truncation, or deletion on Cisco SD-WAN controllers. It monitors for the execution of utilities like 'rm', 'shred', 'truncate', 'bash', 'cat', and 'echo' targeting critical system logs, including '/var/log/auth.log' and various 'vdebug' log files. By detecting these anti-forensic techniques, the rule flags potential attempts by adversaries to conceal post-exploitation activity or clear audit trails.
Detects unauthorized modifications to the vmanage-admin password on Cisco SD-WAN Manager. This rule is designed to identify suspicious credential changes that deviate from standard administrative practices, potentially indicating an actor modifying the default admin credentials for persistence or unauthorized access before attempting to revert the changes to evade detection.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
Detects suspicious authentication and management events associated with SD-WAN devices, specifically targeting indicators of CVE-2026-20245 exploitation. The rule monitors for unauthorized SSH access, usage of tenant-upload commands, execution of rogue scripts like vconfd_script_upload_tenant_list, and anomalous peering activity indicative of device injection.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
Detects administrative commands (e.g., showing running configuration, copying startup configuration, or accessing enable secret) executed via SSH or Telnet on network devices from non-baseline management IP addresses.
Monitors Cisco SD-WAN (vManage, vBond, vSmart) appliance logs for authentication events against management accounts. It specifically identifies logins from known malicious IP addresses associated with threat actor activities and flags anomalous authentication methods such as PAM/keyboard-interactive and unvalidated administrative access.
This rule monitors Cisco SD-WAN environment logs for indicators of unauthorized or suspicious control plane activity, including rogue peering attempts, unexpected NETCONF interactions, certificate mismatches, and unauthorized vBond/vSmart connections. It filters out known local management subnets and utilizes a threat intelligence lookup to identify potentially malicious infrastructure attempting to interface with the SD-WAN fabric.
This rule monitors Cisco SD-WAN logs (vManage, auth, and syslog) for suspicious administrative activity including credential manipulation, unauthorized password changes, successful vManage-admin SSH logins, and potential configuration exfiltration via vManage API calls.
Detects potential unauthorized or rogue peer connections within a Cisco SD-WAN infrastructure. The rule monitors certificate-based authentication events for indicators of rogue peers (e.g., certificate mismatches, invalid common names) or connections originating from known malicious IP addresses associated with rogue SD-WAN activity.
Detects anomalous SSH lateral movement originating from the Cisco SD-WAN Manager (vManage) to other control plane components (vSmart/vBond). This rule correlates network connections on port 22 with successful SSH logins using privileged or service-related accounts, which is indicative of potential post-exploitation activity or pivoting within an SD-WAN control plane environment.
This rule detects potentially malicious activities on network devices by monitoring Syslog messages for account creation with high privileges, privilege abuse, configuration wiping, and anomalous SSH logins from unauthorized source IP addresses. The rule aggregates these events to identify multi-stage exploitation patterns on network infrastructure.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
This rule detects potentially malicious activities on network devices by monitoring Syslog messages for account creation with high privileges, privilege abuse, configuration wiping, and anomalous SSH logins from unauthorized source IP addresses. The rule aggregates these events to identify multi-stage exploitation patterns on network infrastructure.
This rule detects the use of 'chmod' or 'chown' commands on critical system directories ('/etc', '/bin', '/usr', '/sbin') on Cisco vManage, vSmart, and vEdge networking appliances. Such activity could indicate unauthorized modification of system files, persistence attempts, or privilege escalation by an adversary targeting the networking infrastructure.
Detects suspicious access to network device configuration files or routing table exports, potentially indicating compromise by the Salt Typhoon threat actor. This rule correlates file access events on critical configuration files (e.g., running-config, startup-config, BGP routes) within sensitive directories with network or remote interactive logons by local administrators.
Detects Server-Side Request Forgery (SSRF) attempts targeting Cisco WebDialer by identifying network connections or process command lines that include WebDialer and attempt to access loopback addresses (127.0.0.1, localhost, ::1), link-local addresses (169.254.169.254), private IP ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12), or 'file://' and 'gopher://' schemes. This rule leverages UDM for principal and target context.
Detects Server-Side Request Forgery (SSRF) attempts targeting Cisco WebDialer by identifying network connections or process command lines that include WebDialer and attempt to access loopback addresses (127.0.0.1, localhost, ::1), link-local addresses (169.254.169.254), private IP ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12), or 'file://' and 'gopher://' schemes. This rule leverages UDM for principal and target context.
Detects attempts to modify Cisco ROMMON firmware for deep persistence
This rule detects attempts to dump router configuration via a Telnet session. Specifically, it looks for the string "show running-config" being sent to a Telnet server on the home network. This command is commonly used on network devices to display their current running configuration, and its use over an unencrypted protocol like Telnet could indicate unauthorized access or data exfiltration.
This rule alerts when edge router settings change outside an approved maintenance window. Surprise config changes can redirect traffic or weaken security controls. Confirm change tickets and the engineer responsible. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Page 3 of 8