Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
338 detections
Filters
Last updated
All Time
Detection languages
160
100
45
16
7
Contributors
61
49
48
38
34
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
137
125
40
34
20
Products / Services
84
74
48
34
29
MITRE Techniques
127
86
48
45
36
CVEs
4
3
2
2
2
IDS Classtypes
1
1
IDS Protocols
1
This rule detects when the Windows Filtering Platform (WFP) blocks a network connection initiated by a known Endpoint Detection and Response (EDR) agent binary. Adversaries may manipulate WFP filters to prevent EDR agents from communicating with their command and control servers or reporting security events, thereby impairing defensive capabilities. The rule specifically looks for Event ID 5157 (A Windows Filtering Platform callout blocked a connection) and checks if the `Application` field ends with the executable names of various common EDR products.
Detects when a rule has been modified in the Windows Firewall exception list. This can indicate an adversary attempting to bypass host-based firewall controls to enable command and control, lateral movement, or data exfiltration.
Detects when all rules have been deleted from the Windows Defender Firewall configuration. This action can be performed by an attacker to bypass network controls and facilitate command and control, lateral movement, or data exfiltration.
This rule detects when a single rule or all rules have been deleted from the Windows Defender Firewall exception list. This activity can indicate an adversary attempting to impair defenses by removing firewall restrictions to facilitate command and control, lateral movement, or data exfiltration.
This rule identifies when an Azure Firewall resource is created, modified, or deleted within an Azure subscription. This activity is captured through Azure Activity Logs, specifically looking for 'MICROSOFT.NETWORK/AZUREFIREWALLS/WRITE' (for creation/modification) and 'MICROSOFT.NETWORK/AZUREFIREWALLS/DELETE' operations. Such changes can indicate legitimate administrative actions or potentially malicious attempts to alter network defenses.
This rule detects the execution of `iptables` commands that configure TCP port redirection, specifically looking for the `--to-ports 42` or `--to-ports 43` arguments. This behavior is associated with the BPFDoor malware, which uses iptables to redirect incoming traffic on a specific port (e.g., SSH port 22) to a different, often higher, port where its shell is listening, effectively bypassing firewall rules for the attacker's host.
This rule detects the usage of cleartext protocols over a network by monitoring firewall logs for allowed connections to specific destination ports commonly associated with unencrypted services. These ports include HTTP (80, 8080), FTP (21), Telnet (23), and various database or application-specific ports (e.g., 1433, 3306, 1521, 27017, 50000, 11211, 15672, 5900-5904). The rule specifically looks for 'forward' or 'accept' actions, or connections not marked as 'blocked', indicating active cleartext communication. The primary goal is to identify potential credential exposure or sensitive data transmission over insecure channels.
Identifies when an Azure Network Firewall Policy is modified or deleted. This could indicate an attempt to bypass security controls or disrupt network segmentation.
Detects the stopping of system firewall services (firewalld, iptables, ufw) on Linux systems. Adversaries may disable firewalls to bypass network controls, facilitate C2 communications, lateral movement, or data exfiltration.
This rule detects the execution of the 'netsh.exe' utility specifically when it is used to modify existing Windows Advanced Firewall rules. The detection logic looks for 'netsh.exe' being executed with the 'advfirewall' and 'set' options in the command line, indicating an attempt to change properties of an already defined firewall rule. This activity could be indicative of an adversary attempting to bypass network controls to facilitate C2 communications, lateral movement, or data exfiltration.
Identifies when an Azure Firewall Rule Configuration is modified or deleted. This activity can indicate an adversary attempting to bypass network defenses or disrupt services.
Detects when a firewall rule is modified, deleted, or inserted in Google Cloud Platform (GCP). This activity can indicate an adversary attempting to impair defenses or establish persistence by altering network access controls.
This rule detects the execution of `netsh.exe` commands that modify the Windows Firewall to whitelist a program. Specifically, it looks for `netsh.exe` being executed with arguments to 'add allowedprogram' or 'add rule' with 'action=allow' and 'program=' where the program path is located in suspicious directories such as Recycle Bin, System Volume Information, Temp folders, or various Windows system subdirectories that are not typical locations for legitimate applications requiring firewall exceptions.
This rule detects when the Windows Defender Firewall service fails to load Group Policy. This event can indicate an issue with the firewall configuration being applied, potentially leading to a weakened security posture or unexpected network behavior. Adversaries might attempt to interfere with firewall policy loading to bypass defenses.
This rule detects when the Windows Defender Firewall configuration has been reset to its default settings. This action can indicate an attempt by an adversary to disable or modify firewall rules to bypass network controls, facilitate C2 communications, or enable lateral movement. It specifically looks for Event IDs 2032 (for most Windows versions) and 2060 (for Windows 11) from the firewall-as log source.
This rule identifies when Azure Firewall Rule Collections (Application, NAT, and Network) are either modified or deleted. This activity can indicate an attempt to bypass network controls, potentially allowing unauthorized access or data exfiltration. Monitoring these operations is crucial for maintaining network security posture in Azure environments.
Detects when settings of the Windows firewall have been changed, indicated by specific Event IDs from the Windows Defender Firewall with Advanced Security log. This can be an indicator of an adversary attempting to bypass network controls.
Detects the usage of the `netsh.exe` command-line utility to modify system firewall rules, specifically to open port 3389 for RDP connections. This activity has been observed in campaigns involving the Sarwent malware, where adversaries manipulate firewall settings to enable remote access.
Detects the addition of a new rule to the Windows firewall using the 'netsh.exe' command-line utility. This activity can indicate an adversary attempting to bypass network controls for C2 communications, lateral movement, or data exfiltration.
Detects when a user disables the Windows Firewall via a PowerShell command targeting specific profiles (All, Public, Domain, or Private). This activity is often performed by adversaries to evade defense mechanisms and allow unauthorized network communication.
This rule detects the use of 'netsh.exe' to modify Microsoft Defender Firewall rules. Specifically, it looks for command-line arguments that indicate the setting of a new firewall rule with 'group=' and 'enable=Yes', which could be used by adversaries to bypass network controls.
Page 16 of 17