Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
338 detections
Filters
Last updated
All Time
Detection languages
160
100
45
16
7
Contributors
61
49
48
38
34
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
137
125
40
34
20
Products / Services
84
74
48
34
29
MITRE Techniques
127
86
48
45
36
CVEs
4
3
2
2
2
IDS Classtypes
1
1
IDS Protocols
1
Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall. This activity could indicate an adversary attempting to alter network access controls for defense evasion, persistence, or to facilitate further malicious activity.
Detects calls to the "New-NetFirewallRule" cmdlet from PowerShell in order to add a new firewall rule with an "Allow" action. This activity can be indicative of an adversary attempting to bypass network controls for C2, lateral movement, or data exfiltration.
The following analytic detects the modification of firewall settings to allow file and printer sharing. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving 'netsh' commands that enable file and printer sharing. This activity is significant because it can indicate an attempt by ransomware to discover and encrypt files on additional machines connected to the compromised host. If confirmed malicious, this could lead to widespread file encryption across the network, significantly increasing the impact of a ransomware attack.
The following analytic detects a suspicious modification to the firewall to allow network discovery on a machine. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving the 'netsh' command to enable network discovery. This activity is significant because it is commonly used by ransomware, such as REvil and RedDot, to discover and compromise additional machines on the network. If confirmed malicious, this could lead to widespread file encryption across multiple hosts, significantly amplifying the impact of the ransomware attack.
Detects the removal or modification of system firewall rules using common Linux firewall management tools like iptables, firewall-cmd, ufw, and nft. This rule specifically looks for commands that delete or remove existing rules, which adversaries might use to bypass network controls and enable C2 communications, lateral movement, or data exfiltration. This detection aims to catch more granular firewall modifications than just a complete firewall disablement.
Detects when a new rule has been added to the Windows Firewall exception list, specifically looking for uncommon or potentially malicious additions by filtering out common system paths and applications. This rule aims to identify defense evasion attempts where adversaries modify firewall rules to allow their command and control traffic or other malicious network activity.
Detects the removal of a port or application rule in the Windows Firewall configuration using the netsh.exe command-line utility. This activity can be indicative of an adversary attempting to impair defenses to facilitate further malicious activity.
This analytic detects the disabling of logging functionality on a Cisco ASA device through CLI commands. Adversaries or malicious insiders may attempt to disable logging to evade detection and hide malicious activity. The detection looks for specific ASA syslog message IDs (111009, 111010, 111008) associated with command execution, combined with suspicious commands such as `no logging`, `logging disable`, `clear logging`, or `no logging host`. Disabling logging on a firewall or security device is a strong indicator of defense evasion.
This rule detects network traffic blocked by Microsoft Defender Exploit Guard Network Protection or SmartScreen. It categorizes these detections into several types: Indicator of Compromise (IoC) URLs, Web Content Filtering, Malicious/Command & Control, and Cloud App Security Broker (CASB) policy violations. The rule summarizes these events per device, providing counts for each detection category and listing the blocked URLs with timestamps.
This KQL query detects network traffic to or from suspicious ports by joining firewall logs (CommonSecurityLog) with an external, regularly updated list of known suspicious ports. It specifically looks for accepted or passed connections to these ports, indicating potential exploitation attempts or unauthorized communication channels used by threat actors.
This rule detects suspicious activities related to Remote Monitoring and Management (RMM) tools by querying various data sources. It identifies processes, file signatures, network connections, and firewall logs associated with known RMM tools and domains, helping to uncover potential security threats. The rule leverages an external IOC list for RMM tool names, file signatures, and associated domains.
This rule detects successful network connections from external (internet) IP addresses to common Industrial Control System (ICS) ports, such as Modbus (502) and EtherNet/IP (44818). This activity could indicate unauthorized access attempts, reconnaissance, or exploitation of internet-exposed ICS assets. The rule specifically filters for allowed/accepted/permitted connections and excludes connections from RFC 1918 private IP addresses and a configurable list of authorized external IPs.
Detects logs from Palo Alto firewalls indicating possible Impacket tool traffic detection, using categories like spyware or vulnerability and matching specific policy names.
Use MDE device discovery to determine if a SonicWall firewall present in your enterprise environment.
This detection identifies when the ESXi firewall is disabled or set to permissive mode, which can expose the host to unauthorized access and network-based attacks. Such changes are often a precursor to lateral movement, data exfiltration, or the installation of malicious software by a threat actor.
The following analytic detects modifications to the Windows firewall to enable Remote Desktop Protocol (RDP) on a targeted machine. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving "netsh.exe" to allow TCP port 3389. This activity is significant as it may indicate an adversary attempting to gain remote access to a compromised host, a common tactic for lateral movement. If confirmed malicious, this could allow attackers to remotely control the system, leading to potential data exfiltration or further network compromise.
This rule detects suspicious command-line activity related to enabling Remote Desktop Protocol (RDP) access. Specifically, it looks for `netsh.exe` commands that add a firewall rule to allow inbound TCP traffic on port 3389 (RDP) or enable the 'Windows Management Instrumentation (WMI)' firewall group. It also detects `reg.exe` commands that modify the `fDenyTSConnections` registry value to enable RDP connections.
Detects unauthorized modifications to the Palo Alto Networks firewall configuration, potentially indicating malicious activity or security policy violations. These changes can be leveraged to evade detection, facilitate data exfiltration, or disrupt network defenses, ultimately compromising the integrity and security of the environment.
Detects high and critical severity correlation events generated by Palo Alto Networks firewalls' automated correlation engine. The correlation engine connects isolated network events and looks for patterns that indicate a more significant event. This helps identify suspicious traffic patterns and network anomalies which, when correlated, indicate with a high probability that a host on the network has been compromised.
Detects active network communication associated with known malware that is being allowed by the Palo Alto Networks firewall. This may indicate an ongoing security threat, where malicious traffic is bypassing firewall protections, potentially leading to system compromise, data exfiltration, or further infiltration within the network.
This rule detects the modification of an Azure Network Security Group (NSG) rule to allow traffic from any source IP address ('*'). This configuration change significantly broadens network access and could indicate an adversary attempting to establish persistence, enable command and control, or facilitate data exfiltration by opening up previously restricted network paths.
Page 13 of 17