Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
338 detections
Filters
Last updated
All Time
Detection languages
160
100
45
16
7
Contributors
61
49
48
38
34
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
137
125
40
34
20
Products / Services
84
74
48
34
29
MITRE Techniques
127
86
48
45
36
CVEs
4
3
2
2
2
IDS Classtypes
1
1
IDS Protocols
1
The analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. It leverages Cisco Secure Firewall Threat Defense logs and monitors destination ports against a list of non-standard, high-risk port values often used in post-exploitation scenarios. Adversaries frequently configure tools like netcat, Meterpreter, or other backdoors to listen or connect over uncommon ports such as 4444, 2222, or 51820 to bypass standard monitoring and firewall rules. If confirmed malicious, this activity may represent command and control (C2) tunneling, lateral movement, or unauthorized remote access.
The following analytic detects the creation of AWS Network Access Control Lists (ACLs) with all ports open to a specified CIDR. It leverages AWS CloudTrail events, specifically monitoring for `CreateNetworkAclEntry` or `ReplaceNetworkAclEntry` actions with rules allowing all traffic. This activity is significant because it can expose the network to unauthorized access, increasing the risk of data breaches and other malicious activities. If confirmed malicious, an attacker could exploit this misconfiguration to gain unrestricted access to the network, potentially leading to data exfiltration, service disruption, or further compromise of the AWS environment.
This analytic detects network connections flagged by Cisco Secure Firewall's Encrypted Visibility Engine (EVE) with a high threat confidence score (80% or greater). This indicates that the encrypted traffic is highly likely to be malicious, potentially associated with malware command and control (C2), remote access tools, or suspicious tunneling behavior. Such activity could signify covert communication from compromised hosts.
This rule detects suspicious PowerShell commands that modify firewall rules to allow inbound traffic to a specific local port. This activity is significant because it may indicate an attacker attempting to establish remote access by modifying firewall rules, potentially leading to unauthorized access and further exploitation.
This analytic detects suspicious modifications to Windows firewall rules via the registry. Specifically, it looks for changes that allow inbound traffic on any port with a public profile. This activity is significant as it may indicate an adversary attempting to grant remote access to a machine by modifying firewall rules, potentially leading to unauthorized remote access, further exploitation, data exfiltration, or lateral movement within the network.
The analytic detects suspicious modifications to system firewall rules, specifically allowing execution of applications from notable and potentially malicious file paths. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving firewall rule changes. This activity is significant as it may indicate an adversary attempting to bypass firewall restrictions to execute malicious files. If confirmed malicious, this could allow attackers to execute unauthorized code, potentially leading to further system compromise, data exfiltration, or persistence within the environment.
This detection identifies instances where a Windows Firewall rule has been deleted, potentially exposing the system to security risks. Unauthorized removal of firewall rules can indicate an attacker attempting to bypass security controls or malware disabling protections for persistence and command-and-control communication. The event logs details such as the deleted rule name, protocol, port, and the user responsible for the action. Security teams should monitor for unexpected deletions, correlate with related events, and investigate anomalies to prevent unauthorized access and maintain network security posture.
The following analytic detects a potential deletion of firewall rules, indicating a possible security breach or unauthorized access attempt. It identifies actions where firewall rules are removed using commands like netsh advfirewall firewall delete rule, which can expose the network to external threats by disabling critical security measures. Monitoring these activities helps maintain network integrity and prevent malicious attacks.
This detection identifies instances where a Windows Firewall rule has been modified, which may indicate an attempt to alter security policies. Unauthorized modifications can weaken firewall protections, allowing malicious traffic or preventing legitimate communications. The event logs details such as the modified rule name, protocol, ports, application path, and the user responsible for the change. Security teams should monitor unexpected modifications, correlate them with related events, and investigate anomalies to prevent unauthorized access and maintain network security integrity.
The following analytic detects a potential addition or modification of firewall rules, signaling possible configuration changes or security policy adjustments. It tracks commands such as netsh advfirewall firewall add rule and netsh advfirewall firewall set rule, which may indicate attempts to alter network access controls. Monitoring these actions ensures the integrity of firewall settings and helps prevent unauthorized network access.
The analytic identifies the disabling of the firewall using the netsh application. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that include keywords like "firewall," "off," or "disable." This activity is significant because disabling the firewall can expose the system to external threats, allowing malware to communicate with its command and control (C2) server. If confirmed malicious, this action could lead to unauthorized data exfiltration, further malware downloads, and broader network compromise.
The analytic detects suspicious command-line activity that modifies the iptables firewall settings on a Linux machine. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific command patterns that alter firewall rules to accept traffic on certain TCP ports. This activity is significant as it can indicate malware, such as CyclopsBlink, modifying firewall settings to allow communication with a Command and Control (C2) server. If confirmed malicious, this could enable attackers to maintain persistent access and exfiltrate data, posing a severe security risk.
The following analytic identifies 'netsh' processes that delete or modify firewall configurations. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions containing specific keywords. This activity is significant because it can indicate malware, such as NJRAT, attempting to alter firewall settings to evade detection or remove traces. If confirmed malicious, this behavior could allow an attacker to disable security measures, facilitating further compromise and persistence within the network.
The analytic detects the modification of a firewall rule to allow the execution of a specific application. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events with command-line arguments related to firewall rule changes. This activity is significant as it may indicate an attempt to bypass firewall restrictions, potentially allowing unauthorized applications to communicate over the network. If confirmed malicious, this could enable an attacker to execute arbitrary code, escalate privileges, or maintain persistence within the target environment.
This detection identifies instances where a Windows Firewall rule is added by monitoring Event ID 4946 in the Windows Security Event Log. Firewall rule modifications can indicate legitimate administrative actions, but they may also signal unauthorized changes, misconfigurations, or malicious activity such as attackers allowing traffic for backdoors or persistence mechanisms. By analyzing fields like RuleName, RuleId, Computer, and ProfileChanged, security teams can determine whether the change aligns with expected behavior. Correlating with user activity and process execution can help distinguish false positives from real threats, ensuring better visibility into potential security risks.
Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE). This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule". This activity is often associated with defense evasion tactics to allow adversary communications or lateral movement.
Detects when a PowerShell script uses the 'New-NetFirewallRule' cmdlet to create a new firewall rule with an 'Allow' action. This activity can indicate an adversary attempting to bypass host-based firewalls to enable command and control, lateral movement, or data exfiltration.
Detects the addition of a new rule to the Windows Firewall exception list for an application located in a potentially suspicious location. Adversaries may modify system firewalls to bypass controls limiting network usage, enabling C2 communications, lateral movement, and/or data exfiltration.
This rule detects when a new Google Cloud Platform (GCP) firewall rule is created that allows traffic from any source IP address (0.0.0.0/0) on all protocols. This configuration significantly broadens the attack surface and could indicate a misconfiguration or malicious activity aimed at bypassing network defenses.
Detect when a GCP Firewall rule is opened to the world (0.0.0.0/0) on all protocols.
Detect when an AWS security group is opened to the world (0.0.0.0/0) or (::/0)
Page 15 of 17