Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
65 detections
Filters
Last updated
All Time
Detection languages
37
16
5
5
1
Contributors
17
9
8
7
4
Categories
20,425
11,812
5,870
5,145
4,864
Platforms
38
14
10
5
3
Products / Services
19
15
8
6
5
MITRE Techniques
17
16
13
10
10
CVEs
1
This rule detects Denial of Service (DoS) activity originating from an Amazon EC2 instance, as identified by AWS GuardDuty. It specifically looks for GuardDuty findings where the product event type indicates a DenialOfService event and filters out any sample findings.
This rule detects when the Windows Filtering Platform (WFP) blocks a network connection initiated by a known Endpoint Detection and Response (EDR) agent binary. Adversaries may manipulate WFP filters to prevent EDR agents from communicating with their command and control servers or reporting security events, thereby impairing defensive capabilities. The rule specifically looks for Event ID 5157 (A Windows Filtering Platform callout blocked a connection) and checks if the `Application` field ends with the executable names of various common EDR products.
Page 4 of 4