Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,154 detections
Filters
Last updated
All Time
Detection languages
683
379
342
230
173
Contributors
630
378
354
145
119
Categories
841
831
746
393
348
Platforms
1,587
586
494
263
118
Products / Services
10,670
9,758
6,693
4,421
3,749
2,154
MITRE Techniques
655
561
383
337
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
This analytic detects suspicious Python package installations where the package name resembles popular Python libraries but may be typosquatted or slightly altered. Typosquatting is a common technique used by attackers to trick users into installing malicious packages that mimic legitimate ones. This detection leverages Cisco NVM flow telemetry and checks for pip or poetry package managers with the "install" or "add" flags, making outbound connections to package repository such as `pypi.org` with known or suspected typo package names.
This analytic identifies the use of Chromium-based browsers (like Microsoft Edge) running in headless mode with the `--dump-dom` argument. This behavior has been observed in attack campaigns such as DUCKTAIL, where browsers are automated to stealthily download content from the internet using direct URLs or suspicious hosting platforms. The detection focuses on identifying connections to known file-sharing domains or direct IPs extracted from command-line arguments and cross-checks those against the destination of the flow. Since it leverages Cisco Network Visibility Module telemetry, the rule triggers only if a network connection is made.
This analytic detects oversized Cisco Smart Install (SMI) protocol messages by inspecting traffic to TCP port 4786 within the Network_Traffic data model. Abnormally large SMI payloads have been associated with exploitation and protocol abuse (e.g., CVE-2018-0171; activity reported by the "Static Tundra" threat actor). Monitoring message sizes over time can help identify possible attempts at remote code execution, denial of service, or reconnaissance against Cisco devices exposing Smart Install.
This analytic detects network traffic to TCP port 4786, which is used by the Cisco Smart Install protocol. Smart Install is a plug-and-play configuration and image-management feature that helps customers to deploy Cisco switches. This protocol has been exploited via CVE-2018-0171, a vulnerability that allows unauthenticated remote attackers to execute arbitrary code or cause denial of service conditions. Recently, Cisco Talos reported that a Russian state-sponsored threat actor called "Static Tundra" has been actively exploiting this vulnerability to compromise unpatched and end-of-life network devices. Monitoring for traffic to this port can help identify potential exploitation attempts or unauthorized Smart Install activity.
This detection identifies execution of the file synchronization utility "rclone" with network activity, as captured by Cisco Network Visibility Module flow data. It specifically looks for `rclone.exe` or `rclone` commands with arguments indicative of data transfer to cloud storage providers (e.g., `copy`, `remote:`, `mega:`, `ftp:`) and suspicious flags (`--transfers`, `--ignore-existing`, `--auto-confirm`). Rclone is a legitimate tool but is frequently abused by threat actors for data exfiltration or cloud abuse.
This analytic detects suspicious use of `rundll32.exe` in combination with `mshtml.dll` and the export `RunHTMLApplication`. This behavior is often observed in malware to execute JavaScript or VBScript in memory, enabling payload staging or bypassing script execution policies and bypassing the usage of the "mshta.exe" binary. The detection leverages Cisco Network Visibility Module telemetry which offers network flow activity along with process information such as command-line arguments. If confirmed malicious, this activity may indicate initial access or payload download.
Detects activity related to the PromptLock ransomware, which leverages the Ollama AI API and is written in Go. This rule looks for network connections to the Ollama service (port 11434) and related process executions, specifically identifying processes like go.exe, curl.exe, wget.exe, python.exe, powershell.exe making connections or processes with 'ollama' in their command line.
Detects outbound Network File System (NFS) connections originating from an internal network IP address to a public IP address. This activity is highly unusual for legitimate NFS usage and could indicate an attempt to download malware, exfiltrate data, or establish command and control, as observed with malware like RapperBot.
Detects attempts to exploit the Citrix NetScaler RCE vulnerability (CVE-2025-7775) by identifying a specific POST request to a vulnerable endpoint, followed by a GET request to verify code execution.
Detects network requests to common IP geolocation services, such as 'ip-api.com/json'. This is a known anti-analysis technique used by malware, including a loader associated with the Silver Fox APT group, to determine if it is running in a research or sandbox environment by checking the public IP address, ISP, and organization.
Detects a specific, outdated Internet Explorer user-agent string used by the UpCrypter malware for C2 communications. This User-Agent string is highly specific and outdated, making legitimate use extremely unlikely in modern environments.
Detects SQL injection attempts targeting FortiWeb (CVE-2025-25257) in HTTP GET requests to /api/fabric/device/status. The rule identifies known exploit payloads in the Authorization header, generic SQL injection patterns, and SQL statements like DROP, DELETE, INSERT, UPDATE, CREATE. It also detects known malicious source IPs targeting the vulnerable endpoint.
Detects outbound API calls to api.github.com for repository creation or file uploads matching patterns used in the s1ngularity supply chain attack.
Detects when a single Autonomous System Number (ASN) is associated with multiple organization names within a short time frame. This could indicate a rebranding or transfer of network blocks to evade sanctions or scrutiny, as seen with the Stark Industries threat activity enabler.
This KQL query detects network traffic to or from suspicious ports by joining firewall logs (CommonSecurityLog) with an external, regularly updated list of known suspicious ports. It specifically looks for accepted or passed connections to these ports, indicating potential exploitation attempts or unauthorized communication channels used by threat actors.
This rule detects an unusually high volume of DNS queries originating from a single device within a one-hour window. This behavior can be indicative of various malicious activities such as DNS tunneling for command and control, data exfiltration, or extensive reconnaissance.
This analytic detects activity associated with "Static Tundra" threat actor abuse of the Cisco Smart Install (SMI) protocol using Cisco Secure Firewall Intrusion Events. It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify occurrences of Smart Install exploitation and protocol abuse, including denial-of-service and buffer overflow attempts. The detection triggers when multiple Cisco Smart Install-related Snort signatures are observed in a short period from the same source, which is indicative of active exploitation or reconnaissance against Cisco devices that expose SMI.
This detection rule identifies potential exploitation attempts of CVE-2024-36401, a JXPath injection vulnerability in GeoServer. Attackers can send malicious WFS, WMS, or WPS requests to achieve remote code execution. The rule looks for common GeoServer service paths and request types combined with Java code execution strings in web server or network logs.
This analytic identifies instances where an internal host has attempted to communicate with 250 or more destination IP addresses using the same port and protocol. Horizontal port scans from internal hosts can indicate reconnaissance or scanning activities, potentially signaling malicious intent or misconfiguration. By monitoring network traffic logs, this detection helps detect and respond to such behavior promptly, enhancing network security and preventing potential threats.
This analytic identifies instances where an internal host has attempted to communicate with 250 or more destination IP addresses using one of the NMAP top 20 ports. Horizontal port scans from internal hosts can indicate reconnaissance or scanning activities, potentially signaling malicious intent or misconfiguration. By monitoring network traffic logs, this detection helps detect and respond to such behavior promptly, enhancing network security and preventing potential threats.
Detects potential exploitation attempts against Ivanti Connect Secure devices for vulnerability CVE-2025-22457. This vulnerability is actively exploited in the wild. Attackers can send an abnormally long string composed of digits and periods in the 'X-Forwarded-For' HTTP header to trigger a stack-based buffer overflow, which can lead to remote code execution.
Page 91 of 103