Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
654 detections
Filters
Last updated
All Time
Detection languages
268
246
33
31
27
Contributors
207
128
118
98
20
Categories
20,443
11,831
5,872
5,155
4,866
654
Platforms
430
208
97
32
29
Products / Services
270
154
77
73
40
MITRE Techniques
326
308
201
105
97
CVEs
5
2
2
1
1
IDS Classtypes
177
67
11
9
3
IDS Protocols
129
108
16
7
3
This analytic detects instances where an internal host attempts to communicate with over 500 ports on a single destination IP address. It includes filtering criteria to exclude applications performing scans over ephemeral port ranges, focusing on potential reconnaissance or scanning activities. Monitoring network traffic logs allows for timely detection and response to such behavior, enhancing network security by identifying and mitigating potential threats promptly.
NetworkSignatureInspected just means the network sensor saw and matched a signature (it inspected the packet) — it doesn’t mean the flow was blocked. That’s the problem.
If your machines are negotiating SMB or NTLM with unknown remote IPs, you’ve got a real risk on your hands: data leakage, credential relay, or worm-style propagation. SMB to the Internet is almost never legitimate; if you don’t recognize the remote IP, treat it as suspicious.
The KQL query includes multiple conditions to detect not only default connections on legacy (139) or modern (445) SMB ports, but also cases where SMB is running over non-standard ports (attempts to evade simple port-based detection). It also extracts the SMB negotiation state so you can spot repeated or incomplete negotiation attempts (useful to detect scanning, failed auths, or relay attempts).
If your machines are negotiating SMB or NTLM with unknown remote IPs, you’ve got a real risk on your hands: data leakage, credential relay, or worm-style propagation. SMB to the Internet is almost never legitimate; if you don’t recognize the remote IP, treat it as suspicious.
The KQL query includes multiple conditions to detect not only default connections on legacy (139) or modern (445) SMB ports, but also cases where SMB is running over non-standard ports (attempts to evade simple port-based detection). It also extracts the SMB negotiation state so you can spot repeated or incomplete negotiation attempts (useful to detect scanning, failed auths, or relay attempts).
KQL Query from file: Endpoint SMB Exposed on Public Internet
This KQL Query is oriented to extract the different bits of TCP Flags which helps to review the different state of the connections and identify possible threats associated.
In addition, it allows to filter by specific TCP Flag to detect specific threats based on every case.
In addition, it allows to filter by specific TCP Flag to detect specific threats based on every case.
This analytic detects activity associated with "Static Tundra" threat actor abuse of the Cisco Smart Install (SMI) protocol using Cisco Secure Firewall Intrusion Events. It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify occurrences of Smart Install exploitation and protocol abuse, including denial-of-service and buffer overflow attempts. The detection triggers when multiple Cisco Smart Install-related Snort signatures are observed in a short period from the same source, which is indicative of active exploitation or reconnaissance against Cisco devices that expose SMI.
This analytic identifies instances where an internal host has attempted to communicate with 250 or more destination IP addresses using the same port and protocol. Horizontal port scans from internal hosts can indicate reconnaissance or scanning activities, potentially signaling malicious intent or misconfiguration. By monitoring network traffic logs, this detection helps detect and respond to such behavior promptly, enhancing network security and preventing potential threats.
This analytic identifies instances where an internal host has attempted to communicate with 250 or more destination IP addresses using one of the NMAP top 20 ports. Horizontal port scans from internal hosts can indicate reconnaissance or scanning activities, potentially signaling malicious intent or misconfiguration. By monitoring network traffic logs, this detection helps detect and respond to such behavior promptly, enhancing network security and preventing potential threats.
This rule identifies a source IP address that is triggering a variety of Akamai WAF rules across multiple hosts, which is indicative of broad scanning or reconnaissance activity. It aggregates events by source IP within 30-minute windows, counting distinct WAF rules and hosts targeted. The rule then applies thresholds to identify suspicious behavior, specifically looking for an IP that triggers more than 5 distinct WAF rules, targets more than 2 distinct hosts, and generates over 10 denied events.
This detection identifies potential usage of the Naabu port scanner by searching for its process execution or its specific network user-agent string. Naabu is a fast port scanner that can be used for network reconnaissance.
This analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. It leverages Cisco Secure Firewall Threat Defense logs and identifies connections where the action is set to Block, and the number of occurrences reaches or exceeds a threshold of ten within a one-minute span. This pattern may indicate a misconfigured application, unauthorized access attempts, or early stages of a brute-force or scanning operation. If confirmed malicious, this behavior may represent an attacker probing the network, attempting lateral movement, or testing firewall rules for weaknesses.
KQL Query
KQL Query
KQL Query from file: External Attack Surface Monitoring KQL
KQL Query from file: Threat Hunting - MDE Network Intrusion Discovery
KQL Query from file: DefenderXDR Medusa Ransomware Detection
KQL Query from file: Hunting Rogue Endpoints via SMB Detection
KQL Query
"This Kusto (KQL) hunting query detects blob-enumeration or file-spraying behaviour in Azure Storage by:
- Aggregating requests into time-bound sessions with row_window_session().
- Defining a "user" as the combination of AccountName | UserAgentHeader, which is tolerant of rapid IP rotation.
- Raising an alert when, within any single session:
- The actor touches at least 10 distinct objects, and
- At least 50 % of those requests return an HTTP 4xx/5xx status, and
- Each object is accessed exactly once ("touch-once" pattern typical of enumeration).
All tuning knobs (look-back window, session gap, thresholds, authentication type) are exposed at the top of the query.
Be sure to validate the query against both benign and malicious samples in your own environment before relying on it for production detection.
Reference: https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/protect-your-storage-resources-against-blob-hunting/3735238"
- Aggregating requests into time-bound sessions with row_window_session().
- Defining a "user" as the combination of AccountName | UserAgentHeader, which is tolerant of rapid IP rotation.
- Raising an alert when, within any single session:
- The actor touches at least 10 distinct objects, and
- At least 50 % of those requests return an HTTP 4xx/5xx status, and
- Each object is accessed exactly once ("touch-once" pattern typical of enumeration).
All tuning knobs (look-back window, session gap, thresholds, authentication type) are exposed at the top of the query.
Be sure to validate the query against both benign and malicious samples in your own environment before relying on it for production detection.
Reference: https://techcommunity.microsoft.com/blog/microsoftdefendercloudblog/protect-your-storage-resources-against-blob-hunting/3735238"
'This query looks at correlating different reconnaissance alerts with interactive logon logs to help analysts investigate initial possible compromise activity'
Query for processes that accessed more than 10 IP addresses over port 445 (SMB) - possibly scanning for network shares.
To read more about Network Share Discovery, see: https://attack.mitre.org/wiki/Technique/T1135.
Tags: #SMB, #NetworkScanning, #UniqueProcessId.
To read more about Network Share Discovery, see: https://attack.mitre.org/wiki/Technique/T1135.
Tags: #SMB, #NetworkScanning, #UniqueProcessId.
'Identifies when 30 or more ports are used for a given client IP in 10 minutes occurring on the IIS server.
This could be indicative of attempted port scanning or exploit attempt at internet facing web applications.
This could also simply indicate a misconfigured service or device.
References:
IIS status code mapping - https://support.microsoft.com/help/943891/the-http-status-code-in-iis-7-0-iis-7-5-and-iis-8-0
Win32 Status code mapping - https://msdn.microsoft.com/library/cc231199.aspx'
This could be indicative of attempted port scanning or exploit attempt at internet facing web applications.
This could also simply indicate a misconfigured service or device.
References:
IIS status code mapping - https://support.microsoft.com/help/943891/the-http-status-code-in-iis-7-0-iis-7-5-and-iis-8-0
Win32 Status code mapping - https://msdn.microsoft.com/library/cc231199.aspx'
Page 30 of 32