Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
70 detections
Filters
Last updated
All Time
Detection languages
29
15
13
4
3
Contributors
20
11
8
8
5
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
39
20
16
4
3
Products / Services
16
13
10
9
8
MITRE Techniques
18
18
14
10
10
CVEs
1
1
1
1
Detects the use of the 'netsh interface portproxy' command to set up a port forwarding rule where the connection address is outside of common private IP ranges. This behavior is frequently associated with attackers establishing persistent network pivots or internal proxies to redirect C2 traffic.
Detects the configuration of network tunnels or IPsec-related settings using tools such as ip, setkey, racoon, or strongswan by a non-root user. This behavior is indicative of potential unauthorized tunnel establishment or lateral movement activities where a standard user attempts to bypass network controls.
Detects the use of native Windows binaries 'netsh.exe' to establish port proxies or 'pktmon.exe' for network packet monitoring/filtering by processes that are not signed by Microsoft. This behavior is indicative of network tunneling or C2 communication techniques used by actors such as Volt Typhoon to maintain persistence and establish network pivots.
This rule detects network connections using the GRE (Generic Routing Encapsulation) protocol to external IP addresses. GRE is often used for tunneling and can be leveraged by adversaries for command and control or data exfiltration, especially when communicating outside of internal network ranges.
This rule detects potential tunnel creation using PowerShell. It identifies network connections from PowerShell processes to common SSH (22) or Tor (9001, 9050) ports, as well as PowerShell script block activity involving socket connections directed at .onion domains, SSH keys, or authorized keys files, which may indicate remote access tunneling or command-and-control communication.
Detects the use of the 'netsh interface portproxy' command to set up a port forwarding rule where the connection address is outside of common private IP ranges. This behavior is frequently associated with attackers establishing persistent network pivots or internal proxies to redirect C2 traffic.
Detects the use of the 'netsh interface portproxy' command to set up a port forwarding rule where the connection address is outside of common private IP ranges. This behavior is frequently associated with attackers establishing persistent network pivots or internal proxies to redirect C2 traffic.
Detects the use of native Windows binaries 'netsh.exe' to establish port proxies or 'pktmon.exe' for network packet monitoring/filtering by processes that are not signed by Microsoft. This behavior is indicative of network tunneling or C2 communication techniques used by actors such as Volt Typhoon to maintain persistence and establish network pivots.
This rule detects unauthorized configuration of GRE tunnels on Cisco IOS-XE network devices, potentially indicating persistent command and control (C2) channel establishment via TCL injection or illicit configuration changes involving known attacker infrastructure (62.171.185.97). It correlates network traffic to the attacker IP with process-level activity involving suspicious configuration files, scripts, or device-specific command-line arguments.
Detects suspicious authentication and management events associated with SD-WAN devices, specifically targeting indicators of CVE-2026-20245 exploitation. The rule monitors for unauthorized SSH access, usage of tenant-upload commands, execution of rogue scripts like vconfd_script_upload_tenant_list, and anomalous peering activity indicative of device injection.
Detects network connections using the GRE (Generic Routing Encapsulation) protocol destined for non-internal (outside of RFC 1918) IP addresses. GRE is frequently used for tunneling traffic and, when used to communicate with external hosts, may indicate unauthorized tunneling or data exfiltration.
This rule monitors for Generic Routing Encapsulation (GRE) network traffic originating from or destined to non-private (non-RFC1918) IP addresses. GRE is often used for tunneling protocols and can be abused to bypass network security controls or establish hidden command and control communication channels.
This rule monitors Cisco SD-WAN environment logs for indicators of unauthorized or suspicious control plane activity, including rogue peering attempts, unexpected NETCONF interactions, certificate mismatches, and unauthorized vBond/vSmart connections. It filters out known local management subnets and utilizes a threat intelligence lookup to identify potentially malicious infrastructure attempting to interface with the SD-WAN fabric.
This rule detects the execution of iptables or xtables commands to create a network redirection rule. Specifically, it looks for commands that use 'REDIRECT', '--to-ports', and either 'PREROUTING' or 'nat' in the command line, indicating an attempt to redirect network traffic, potentially for proxying or other malicious network manipulation.
Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been opened up in the AWS account.
Detects the addition of a new network route to a route table in AWS.
Cisco Sniffing
Sigma
Show when a monitor or a span/rspan is setup or modified
Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6. In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic. This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.
Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6.
In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic.
This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.
In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic.
This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.
This detection identifies a single MAC address rapidly appearing on multiple switch ports within a short time frame. This behavior, known as MAC flapping, is a strong indicator of a network loop, which can cause broadcast storms and degrade or disable network services.
This analytic detects the creation or modification of network interfaces on Cisco devices, which could indicate an attacker establishing persistence or preparing for lateral movement. After gaining initial access to network devices, threat actors like Static Tundra often create new interfaces (particularly loopback interfaces) to establish covert communication channels or maintain persistence. This detection specifically looks for the configuration of new interfaces, interface state changes, and the assignment of IP addresses to interfaces. These activities are particularly concerning when they involve unusual interface names or descriptions containing suspicious terms.
Page 3 of 4