Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
219 detections
Filters
Last updated
All Time
Detection languages
109
46
38
12
5
Contributors
46
46
32
31
21
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
158
61
34
25
4
Products / Services
115
75
58
19
18
MITRE Techniques
91
48
34
27
19
CVEs
4
2
1
1
1
IDS Classtypes
50
20
16
6
5
IDS Protocols
44
23
21
9
6
Detects a Python process spawning msiexec.exe followed by a high volume of LDAP connections (burst) from the same device within a 30-minute window, potentially indicating post-exploitation activity such as domain enumeration.
Detects inbound UDP traffic on port 443 (QUIC) targeting known HTTP/3-capable server processes (such as Caddy, Traefik, Cloudflared) followed closely by the termination or crash of that process, which may indicate an exploit attempt or vulnerability leading to denial of service.
Detects connections held open far longer than normal. Interactive command and
control, tunnelling and remote access tooling all maintain long sessions, whereas
ordinary application traffic is short-lived and bursty.
Duration is available directly in the connection record, which makes this far
cheaper to evaluate than reconstructing sessions from flow data.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-connection where sourcename='NTA'
and action='CONNECTION_ESTABLISHED'
| duration 24h
| groupby srcip, dstip, dstport, app, duration
control, tunnelling and remote access tooling all maintain long sessions, whereas
ordinary application traffic is short-lived and bursty.
Duration is available directly in the connection record, which makes this far
cheaper to evaluate than reconstructing sessions from flow data.
Onboarding: NTA is ingested via Network Traffic Analysis (Bloo extractor 717).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=nta-connection where sourcename='NTA'
and action='CONNECTION_ESTABLISHED'
| duration 24h
| groupby srcip, dstip, dstport, app, duration
The following analytic identifies ICMP traffic to external IP addresses with total bytes (sum of bytes in and bytes out) greater than 1,000 bytes.
It leverages the Network_Traffic data model to detect large ICMP packet that aren't blocked and are directed toward external networks. We use All_Traffic.bytes in the detection to capture variations in inbound versus outbound traffic sizes, as significant discrepancies or unusually large ICMP exchanges can indicate information smuggling, covert communication, or command-and-control (C2) activities.
If validated as malicious, this could signal ICMP tunneling, unauthorized data transfer, or compromised endpoints requiring immediate investigation.
It leverages the Network_Traffic data model to detect large ICMP packet that aren't blocked and are directed toward external networks. We use All_Traffic.bytes in the detection to capture variations in inbound versus outbound traffic sizes, as significant discrepancies or unusually large ICMP exchanges can indicate information smuggling, covert communication, or command-and-control (C2) activities.
If validated as malicious, this could signal ICMP tunneling, unauthorized data transfer, or compromised endpoints requiring immediate investigation.
Detects a Unix-based (Linux or macOS) browser process spawning a Unix shell that establishes an outbound connection to an external destination.
This browser-to-shell execution chain may indicate malicious browser content, drive-by execution, a compromised website, or abuse of a browser extension on Linux or macOS systems.
The behavior may also occur during legitimate development, installation, automation, or enterprise software workflows.
This browser-to-shell execution chain may indicate malicious browser content, drive-by execution, a compromised website, or abuse of a browser extension on Linux or macOS systems.
The behavior may also occur during legitimate development, installation, automation, or enterprise software workflows.
The following analytic detects MSIExec making network connections over ports 443 or 80. This behavior is identified by correlating process creation events from Endpoint Detection and Response (EDR) agents with network traffic logs. Typically, MSIExec does not perform network communication to the internet, making this activity unusual and potentially indicative of malicious behavior. If confirmed malicious, an attacker could be using MSIExec to download or communicate with external servers, potentially leading to data exfiltration, command and control (C2) communication, or further malware deployment.
Detects outbound SMTP traffic associated withAVERAT malware, tracking the EHLO sequence, STARTTLS command negotiation, server acceptance, and subsequent custom TLS ClientHello patterns on port 25.
This analytic detects the usage of the Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes (600 seconds).
Adversaries may abuse osascript and AppleScript shell execution to establish long-lived command-and-control or remote connections.
Adversaries may abuse osascript and AppleScript shell execution to establish long-lived command-and-control or remote connections.
Detects outbound SMTP traffic associated withAVERAT malware, tracking the EHLO sequence, STARTTLS command negotiation, server acceptance, and subsequent custom TLS ClientHello patterns on port 25.
Detects outbound SMTP traffic associated withAVERAT malware, tracking the EHLO sequence, STARTTLS command negotiation, server acceptance, and subsequent custom TLS ClientHello patterns on port 25.
Detects outbound SMTP traffic associated withAVERAT malware, tracking the EHLO sequence, STARTTLS command negotiation, server acceptance, and subsequent custom TLS ClientHello patterns on port 25.
This analytic detects unexpected outbound network connections initiated by known webserver processes such as `httpd.exe`, `nginx.exe`, or `tomcat.exe` to common file sharing or public content hosting services like GitHub, Discord CDN, Transfer.sh, or Pastebin.
Webservers are rarely expected to perform outbound downloads, especially to dynamic or anonymous file hosting domains. This behavior is often associated with server compromise,
where an attacker uses a reverse shell, webshell, or injected task to fetch malware or tools post-exploitation.
The detection leverages Cisco Network Visibility Module flow data, enriched with process context, to identify this highly suspicious behavior.
Webservers are rarely expected to perform outbound downloads, especially to dynamic or anonymous file hosting domains. This behavior is often associated with server compromise,
where an attacker uses a reverse shell, webshell, or injected task to fetch malware or tools post-exploitation.
The detection leverages Cisco Network Visibility Module flow data, enriched with process context, to identify this highly suspicious behavior.
Detects high-frequency, short-duration UDP flow activity on NetScaler VPN ports (443/4433) indicative of volumetric or malformed DTLS handshake probing, potentially associated with exploitation attempts like CVE-2026-88772.
Detects potential Cobalt Strike or Sliver command and control (C2) beaconing behavior by analyzing network proxy, firewall, and flow logs for common C2 URI patterns, known malicious JA3/JA3S TLS fingerprints, and consistent periodic communication intervals (low jitter) characteristic of automated beacons.
Detects outbound network connections from Citrix NetScaler appliances that exhibit high periodic regularity (beaconing behavior) towards rare external destinations. This pattern is indicative of potential command and control (C2) communication, possibly following the exploitation of vulnerabilities like CVE-2026-88771/88772.
This analytic detects network connections initiated by binaries that are not typically associated with network communication,
such as 'notepad.exe', 'calc.exe' or 'write.exe'.
It leverages Cisco Network Visibility Module logs to correlate network flow activity with process context, including command-line arguments, process path, and parent process information.
These applications are normally used for locally and do not require outbound network access. When they do initiate such connections, it may indicate process hollowing, code injection, or proxy execution, where adversaries abuse a trusted process to mask malicious activity.
such as 'notepad.exe', 'calc.exe' or 'write.exe'.
It leverages Cisco Network Visibility Module logs to correlate network flow activity with process context, including command-line arguments, process path, and parent process information.
These applications are normally used for locally and do not require outbound network access. When they do initiate such connections, it may indicate process hollowing, code injection, or proxy execution, where adversaries abuse a trusted process to mask malicious activity.
This analytic detects the use of `curl.exe` with insecure flags such as `-k`, `--insecure`, `--proxy-insecure`, or `--doh-insecure`
which disable TLS certificate validation.
It leverages Cisco Network Visibility Module (NVM) flow data and process arguments
to identify outbound connections initiated by curl where TLS checks were explicitly disabled.
This behavior may indicate an attempt to bypass certificate validation to connect to potentially untrusted or malicious endpoints,
a common tactic in red team operations, malware staging, or data exfiltration over HTTPS.
which disable TLS certificate validation.
It leverages Cisco Network Visibility Module (NVM) flow data and process arguments
to identify outbound connections initiated by curl where TLS checks were explicitly disabled.
This behavior may indicate an attempt to bypass certificate validation to connect to potentially untrusted or malicious endpoints,
a common tactic in red team operations, malware staging, or data exfiltration over HTTPS.
Detects high volumes of DTLS/UDP session-initiation traffic targeting NetScaler VPN virtual servers that are immediately followed by appliance-level error logs or crashes. This behavior is indicative of active probing or exploitation attempts, such as those associated with CVE-2026-88772, where malicious payloads cause service instability.
This analytic detects suspicious python package installations where the package name resembles popular Python libraries but may be typosquatted or slightly altered.
Typosquatting is a common technique used by attackers to trick users into installing malicious packages that mimic legitimate ones.
This detection leverages Cisco NVM flow telemetry and checks for pip or poetry package managers with the "install" or "add" flags, making outbound connections to package repository such as `pypi.org` with known or suspected typo package names.
Typosquatting is a common technique used by attackers to trick users into installing malicious packages that mimic legitimate ones.
This detection leverages Cisco NVM flow telemetry and checks for pip or poetry package managers with the "install" or "add" flags, making outbound connections to package repository such as `pypi.org` with known or suspected typo package names.
This analytic detects suspicious use of 'mshta.exe' or 'rundll32.exe' invoking 'mshtml.dll'
or the 'RunHTMLApplication' export without including a direct HTTP/HTTPS URL in the command line.
This pattern could be associated with obfuscated script execution used by threat actors during
initial access or payload staging. The absence of a visible URL may indicate attempts to evade static
detections by embedding the URL via string concatenation, encoding (e.g., hex), or indirect script loaders
like 'GetObject()'.
or the 'RunHTMLApplication' export without including a direct HTTP/HTTPS URL in the command line.
This pattern could be associated with obfuscated script execution used by threat actors during
initial access or payload staging. The absence of a visible URL may indicate attempts to evade static
detections by embedding the URL via string concatenation, encoding (e.g., hex), or indirect script loaders
like 'GetObject()'.
This detection identifies execution of the file synchronization utility "rclone".
It leverages Cisco Network Visibility Module logs, specifically flow data in order to capture process executions
initiating network connections.
While rclone is a legitimate command-line tool for syncing data to cloud storage providers, it has been widely abused by threat actors for data exfiltration.
This analytic inspects process name and arguments for rclone and flags usage of suspicious flags.
If matched, this could indicate malicious usage for stealthy data exfiltration or cloud abuse.
It leverages Cisco Network Visibility Module logs, specifically flow data in order to capture process executions
initiating network connections.
While rclone is a legitimate command-line tool for syncing data to cloud storage providers, it has been widely abused by threat actors for data exfiltration.
This analytic inspects process name and arguments for rclone and flags usage of suspicious flags.
If matched, this could indicate malicious usage for stealthy data exfiltration or cloud abuse.
Page 1 of 11