Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
654 detections
Filters
Last updated
All Time
Detection languages
268
246
33
31
27
Contributors
207
128
118
98
20
Categories
20,443
11,831
5,872
5,155
4,866
654
Platforms
430
208
97
32
29
Products / Services
270
154
77
73
40
MITRE Techniques
326
308
201
105
97
CVEs
5
2
2
1
1
IDS Classtypes
177
67
11
9
3
IDS Protocols
129
108
16
7
3
Detects the execution of common network scanning or service enumeration tools like telnet, nmap, and netcat on Linux systems, as captured by auditd logs. This activity can indicate an adversary attempting to discover local or remote network services.
Detects the use of common network scanning tools like netcat, nmap, and telnet on macOS systems. The rule specifically looks for process creation events where the image path ends with '/nc', '/netcat', '/nmap', or '/telnet'. It includes a filter to exclude 'netcat' commands containing 'l' (often used for legitimate listening modes), aiming to reduce false positives related to simple network listening.
This rule detects suspicious network scanning activity by identifying command-line executions that combine looping constructs ('for', 'foreach') with network discovery tools ('nslookup', 'ping'). This pattern is often used by adversaries to enumerate systems on a network for lateral movement or further reconnaissance.
Page 32 of 32