Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
65 detections
Filters
Last updated
All Time
Detection languages
37
16
5
5
1
Contributors
17
9
8
7
4
Categories
20,425
11,812
5,870
5,145
4,864
Platforms
38
14
10
5
3
Products / Services
19
15
8
6
5
MITRE Techniques
17
16
13
10
10
CVEs
1
This rule detects high-frequency security alerts from Zscaler ZIA indicating that a single source IP has encountered three or more distinct threat signatures within a 15-minute window. This behavior is indicative of a host engaging in malicious activity, such as automated scanning, malware communication attempts, or accessing infrastructure associated with multiple malicious categories.
Detects instances where Netskope security solution has identified and blocked web-based traffic classified as malware or a security threat.
Detects users who have triggered five or more blocks by Netskope security policies for high-risk web categories such as Anonymizers, Hacking, Gambling, or Adult Content. This behavior may indicate an attempt to circumvent security controls or persistent engagement with prohibited content.
Detects Zscaler ZIA logs identified as Advanced Threat Protection events, specifically targeting URL categories like Phishing and WebSpam, or traffic classified as Advanced Security Risk. The rule aggregates these events by user to identify potential malicious activity, flagging sessions where threats were allowed as higher severity.
Detects instances where Zscaler web security logs identify malware, threats, or viruses, specifically flagging users and destination hosts involved in these blocked or allowed security events.
This rule detects high-frequency security alerts from Zscaler ZIA indicating that a single source IP has encountered three or more distinct threat signatures within a 15-minute window. This behavior is indicative of a host engaging in malicious activity, such as automated scanning, malware communication attempts, or accessing infrastructure associated with multiple malicious categories.
Detects users who have triggered five or more blocks by Netskope security policies for high-risk web categories such as Anonymizers, Hacking, Gambling, or Adult Content. This behavior may indicate an attempt to circumvent security controls or persistent engagement with prohibited content.
KQL Query
This rule detects outbound network connections that were blocked by security controls due to matching a threat signature or being categorized as malicious or command-and-control (C2) traffic.
This rule detects when Microsoft Defender SmartScreen identifies and blocks or warns users about access to known 'ClickFix' phishing landing pages. These pages often attempt to social engineer users into executing malicious commands via copy-paste actions (e.g., in a terminal or Run dialog) as a deceptive remediation step for fake browser errors.
This rule monitors Palo Alto Networks firewalls for files identified as malicious by the WildFire or ML-based threat detection engines. It filters out known allowed file hashes and aggregates events to provide a high-confidence alert. The rule categorizes threats based on the verdict ('malicious', 'malware', 'phishing', 'suspicious', 'c2') and distinguishes whether the threat was blocked or delivered to the network, providing context for incident response.
Detects the use of iptables to drop incoming SSH traffic (port 22) on Linux, a behavior observed in KadNap botnet infections. This rule specifically looks for the execution of the `iptables` command with parameters to set an INPUT rule, specify TCP protocol, target destination port 22, and set the jump target to DROP.
This rule detects external brute-force attempts against firewall authentication mechanisms. It triggers when 15 or more failed login attempts from a single external IP address occur within a 15-minute window. The rule specifically filters for 'USER_LOGIN' events with a 'BLOCK' or 'FAIL' security result and excludes internal RFC1918 IP addresses to focus on external threats.
This rule alerts when Cato's inline Anti Malware engine identifies a file in transit as malicious. It fires on both blocked and allowed malware to catch cases where the engine detects but fails to block, indicating a potential compromise or a misconfiguration requiring immediate investigation.
Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (EDR) agents.
Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events.
Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events.
This query identifies URL access attempts that were blocked by CATO Networks security policies, based on logs in CommonSecurityLog. It allows for filtering by specific devices or target URLs.
This rule identifies and aggregates blocked requests from Imperva WAF logs, grouping them by source IP address and then by the owning organization (ASN). It helps to detect and analyze potential attack campaigns or coordinated malicious activity originating from specific organizations or IP ranges. The rule focuses on security, session, and visitor blocks, providing details on attack names, query strings, referrers, and URLs.
This rule detects network traffic blocked by Microsoft Defender Exploit Guard Network Protection or SmartScreen. It categorizes these detections into several types: Indicator of Compromise (IoC) URLs, Web Content Filtering, Malicious/Command & Control, and Cloud App Security Broker (CASB) policy violations. The rule summarizes these events per device, providing counts for each detection category and listing the blocked URLs with timestamps.
This rule correlates Microsoft Defender for Endpoint (MDE) SmartScreen and Network Protection blocks with network activity logs. It specifically looks for instances where SmartScreenUrlWarning or ExploitGuardNetworkProtectionBlocked events occur due to 'CustomBlockList' or 'CustomPolicy' settings. The rule then joins these events with DeviceNetworkEvents to identify the associated URLs, remote IP addresses, and ports involved in the blocked network communication. The primary goal is to identify and provide context for network access attempts that are blocked by custom security policies, indicating potential malicious or unwanted website access.
This analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. It leverages Cisco Secure Firewall Threat Defense logs and identifies connections where the action is set to Block, and the number of occurrences reaches or exceeds a threshold of ten within a one-minute span. This pattern may indicate a misconfigured application, unauthorized access attempts, or early stages of a brute-force or scanning operation. If confirmed malicious, this behavior may represent an attacker probing the network, attempting lateral movement, or testing firewall rules for weaknesses.
The following analytic detects a blocked connection event by identifying a "Block" value in the action field. It leverages logs from Cisco Secure Firewall Threat Defense devices. This activity is significant as it can identify attempts from users or applications initiating network connection to explicitly or implicitly blocked range or zones. If confirmed malicious, attackers could be attempting to perform a forbidden action on the network such as data exfiltration, lateral movement, or network disruption.
Page 2 of 4