Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
6
1
1
Contributors
5
2
1
Categories
5
3
1
1
Platforms
4
1
1
1
1
Products / Services
4
1
1
1
MITRE Techniques
4
4
3
3
2
CVEs
71
71
64
58
49
Detects configuration changes on firewall devices via CommonSecurityLog.
Specifically looks for CONFIG activity that is not an audit-commit,
indicating an actual configuration change was made rather than a
read-only audit operation.
Note: Field aliasing (Client, Administrator, Host_IP, Command, Result,
Configuration_Path, Before_Change, After_Change) via extend,
fixed date window via datetime_local_to_utc, and project-reorder
are handled natively in KQL post-conversion. See third item of the
reference. Original query was scoped to a fixed date window, which is
(2026-02-09 to 2026-02-10 PST) suggesting threat hunting intent.
However, it's worthnoting that Sigma version uses a rolling 24h window
for continuous detection. This is the detection version of my KQL script.
Specifically looks for CONFIG activity that is not an audit-commit,
indicating an actual configuration change was made rather than a
read-only audit operation.
Note: Field aliasing (Client, Administrator, Host_IP, Command, Result,
Configuration_Path, Before_Change, After_Change) via extend,
fixed date window via datetime_local_to_utc, and project-reorder
are handled natively in KQL post-conversion. See third item of the
reference. Original query was scoped to a fixed date window, which is
(2026-02-09 to 2026-02-10 PST) suggesting threat hunting intent.
However, it's worthnoting that Sigma version uses a rolling 24h window
for continuous detection. This is the detection version of my KQL script.
Automate daily manual monitoring of Firewall changes that are performed by the Security Engineer. Additionally, this can be fine-tuned (more on that on next upcoming queries) into an automated rule such as Custom Detection Rule in Defender, Analytics Rule in Sentinel, or Saved Search with Alert Actions within Splunk (SPL) to detect potential changes by unknown authorized individual.
Detects exploitation attempts against common network edge devices (Cisco, Ivanti, Palo Alto) associated with Salt Typhoon's TTPs for initial access.
Detects suspicious file creations within the Palo Alto Networks PAN-OS' parent telemetry folder, specifically looking for filenames containing patterns indicative of OS command injection attempts related to CVE-2024-3400. These files are processed by the 'dt_curl' script, which can lead to arbitrary command execution if device telemetry is enabled and filenames are crafted to bypass shell-subprocess restrictions.
Detects the creation of Python path configuration files (.pth) within Python library folders on Windows systems. These files can be maliciously used for code execution and persistence, as modules referenced by them are executed at every Python startup (v3.5+), regardless of whether they are imported by the calling script. The rule specifically targets files ending with '.pth' in paths matching '\(venv|python(.+)?)\lib\site-packages\', while filtering out known legitimate .pth files like 'pywin32.pth' and 'distutils-precedence.pth'.
Detects the creation of Python path configuration files (.pth) within Python library folders on macOS. These files can be maliciously used for code execution and persistence, as modules referenced by them are executed at every Python startup (v3.5+), regardless of whether they are explicitly imported by a script. The rule specifically looks for files ending with '.pth' in the '/lib/python3.([5-9]|[0-9]{2})/site-packages/' directory structure.
Detects the creation of Python path configuration files (.pth) within Python library folders on Linux systems. These files can be maliciously used for code execution and persistence, as modules referenced by them are executed at every Python startup (v3.5+), regardless of whether they are imported by the calling script. The rule specifically looks for files ending with '.pth' in typical Python site-packages directories.
Detects potential exploitation attempts of CVE-2024-3400, an OS command injection vulnerability in Palo Alto GlobalProtect. The rule looks for suspicious strings indicating directory traversal or command injection within Palo Alto GlobalProtect logs.