Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
338 detections
Filters
Last updated
All Time
Detection languages
160
100
45
16
7
Contributors
61
49
48
38
34
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
137
125
40
34
20
Products / Services
84
74
48
34
29
MITRE Techniques
127
86
48
45
36
CVEs
4
3
2
2
2
IDS Classtypes
1
1
IDS Protocols
1
Detects the manual enablement of network discovery services (fdrespub, fdPHost, SSDPSRV, upnphost) and the associated Windows Firewall rules. This activity is a known tactic used by Gentlemen ransomware to facilitate lateral movement and network share enumeration by making the compromised host visible to others and allowing it to discover peers.
This rule detects potential unauthorized or suspicious installation of an RMM (Remote Monitoring and Management) agent on a Windows host. It flags cases where a process performs multiple suspicious actions within a 24-hour window, specifically combining the installation or starting of a service related to an RMM agent, the creation of a Windows Firewall rule for the RMM agent executable, and/or the creation of log events related to the installer.
Detects the specific pattern associated with Storm-2570 for enabling Remote Desktop Protocol (RDP) on a target host to facilitate lateral movement. The detection looks for registry modifications to disable RDP denial (fDenyTSConnections=0), firewall rules allowing TCP port 3389 via netsh or PowerShell, and the deployment of these configurations using PsExec against a target host list file.
This rule performs a point-in-time IOC hunt within CommonSecurityLog data to detect indicators associated with NeedyMantis. It monitors for specific C2 infrastructure domains ('tripswithengine.com') and a hardcoded user-agent string ('Firefox/21.0') in proxy, firewall, or network logs, which are characteristic of this threat actor's activity.
Detects unauthorized changes to network appliance configurations, specifically the installation of new software packages using opkg or the modification of network address translation (NAT) rules via iptables or nftables. These actions can be used to maintain persistent access or establish covert command and control infrastructure.
This rule detects modification of the Windows Registry to disable the Windows Firewall. Specifically, it monitors for EventID 4657 (A registry value was modified) where the 'EnableFirewall' value is set to '0' within the FirewallPolicy service registry path, indicating an attempt to disable the host-based firewall.
Detects the installation or execution of common Remote Monitoring and Management (RMM) tools (e.g., ScreenConnect, AnyDesk, Atera) that are initiated from potentially untrusted parent processes like browsers, mail clients, or archive utilities, or that exhibit a code signing discrepancy. The rule further correlates these installation events with subsequent modifications to the Windows firewall within a two-hour window, which is indicative of an adversary establishing remote access persistence.
Detects potential persistence and network persistence mechanisms associated with the MSP360 RMM agent. The rule correlates the creation of a Windows service for RMM.Agent.exe or RMM.Agent.Launcher.exe with the addition of a firewall rule allowing UDP traffic on port 48678 by netsh or PowerShell, occurring within a one-hour window.
Detects potential persistence and network persistence mechanisms associated with the MSP360 RMM agent. The rule correlates the creation of a Windows service for RMM.Agent.exe or RMM.Agent.Launcher.exe with the addition of a firewall rule allowing UDP traffic on port 48678 by netsh or PowerShell, occurring within a one-hour window.
This rule detects potential exploitation of CVE-2026-86134, a NULL pointer dereference vulnerability in WatchGuard Fireware. It identifies a burst of authentication-related requests (login, authd, management) targeting a device, followed by system logs indicating a service crash, daemon restart, or core dump within a short correlation window. This behavior is indicative of a Denial of Service attack.
Detects unauthorized attempts to disable or modify Windows Firewall settings across multiple devices. The rule identifies suspicious registry modifications, firewall service termination events, or security policy changes that suggest an adversary is attempting to impair defensive mechanisms.
This rule detects potential unauthorized or suspicious installation of an RMM (Remote Monitoring and Management) agent on a Windows host. It flags cases where a process performs multiple suspicious actions within a 24-hour window, specifically combining the installation or starting of a service related to an RMM agent, the creation of a Windows Firewall rule for the RMM agent executable, and/or the creation of log events related to the installer.
This rule detects potential unauthorized or suspicious installation of an RMM (Remote Monitoring and Management) agent on a Windows host. It flags cases where a process performs multiple suspicious actions within a 24-hour window, specifically combining the installation or starting of a service related to an RMM agent, the creation of a Windows Firewall rule for the RMM agent executable, and/or the creation of log events related to the installer.
Detects high-frequency network scanning patterns characterized by a large volume of unique destination ports or hosts contacted by a single source within a short timeframe. This behavior indicates potential automated reconnaissance, often associated with autonomous agent frameworks or AI-driven tools performing rapid network discovery.
Detects high-frequency connection attempts from a single source IP to multiple destination IPs over the non-standard DVRIP port 37777, often used by Dahua surveillance equipment. This behavior is indicative of automated scanning, brute-forcing, or exploitation attempts targeting vulnerable IoT/CCTV devices.
This rule detects the addition or modification of Windows Firewall rules by applications residing in non-standard or suspicious directories. It monitors Security Events 2004, 2071, and 2097, filtering out known legitimate system paths, common temporary directories, and updates from trusted Microsoft processes such as Windows Defender, svchost.exe, and dllhost.exe. By excluding standard operating system folders and common software installation paths, the rule highlights potentially malicious attempts to establish persistence or facilitate unauthorized network communication by bypassing standard firewall management channels.
This rule performs a point-in-time IOC hunt within CommonSecurityLog data to detect indicators associated with NeedyMantis. It monitors for specific C2 infrastructure domains ('tripswithengine.com') and a hardcoded user-agent string ('Firefox/21.0') in proxy, firewall, or network logs, which are characteristic of this threat actor's activity.
Detects high-velocity, automated authentication failures originating from a single IP against internet-exposed management interfaces. The rule monitors for a rapid sequence of distinct user accounts being targeted in a short time window, indicating AI-driven or automated credential stuffing/brute force activity targeting VPNs or firewalls.
Detects high-velocity, automated authentication failures originating from a single IP against internet-exposed management interfaces. The rule monitors for a rapid sequence of distinct user accounts being targeted in a short time window, indicating AI-driven or automated credential stuffing/brute force activity targeting VPNs or firewalls.
Detects high-velocity, automated authentication failures originating from a single IP against internet-exposed management interfaces. The rule monitors for a rapid sequence of distinct user accounts being targeted in a short time window, indicating AI-driven or automated credential stuffing/brute force activity targeting VPNs or firewalls.
This rule detects the addition or modification of Windows Firewall rules by applications residing in non-standard or suspicious directories. It monitors Security Events 2004, 2071, and 2097, filtering out known legitimate system paths, common temporary directories, and updates from trusted Microsoft processes such as Windows Defender, svchost.exe, and dllhost.exe. By excluding standard operating system folders and common software installation paths, the rule highlights potentially malicious attempts to establish persistence or facilitate unauthorized network communication by bypassing standard firewall management channels.
Page 4 of 17