Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
13 detections
Filters
Last updated
All Time
Detection languages
13
Contributors
8
4
1
Categories
7
5
3
3
2
Platforms
9
5
2
2
Products / Services
6
5
2
2
1
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
This rule detects an unusually high number of network connection events originating from a single device to a remote IP address within a one-minute interval. This behavior can be indicative of various malicious activities, including network scanning, port scanning, or a denial-of-service (DoS) attempt. It could also signal a compromised host attempting to establish numerous connections for command and control, data exfiltration, or further reconnaissance.
This rule detects an unusually high number of network connection events originating from a single device to a remote IP address within a one-minute interval. This behavior can be indicative of various malicious activities, including network scanning, port scanning, or a denial-of-service (DoS) attempt. It could also signal a compromised host attempting to establish numerous connections for command and control, data exfiltration, or further reconnaissance.
This rule identifies potential network scanning or high-volume communication by detecting a large number of connections (50 or more) between a single source IP and a single destination IP within a 5-minute time window. It aggregates connection details such as total connections, sent bytes, and received bytes from the CommonSecurityLog.
This rule identifies potential network scanning or high-volume communication by detecting a large number of connections (50 or more) between a single source IP and a single destination IP within a 5-minute time window. It aggregates connection details such as total connections, sent bytes, and received bytes from the CommonSecurityLog.
KQL Query
KQL Query
KQL Query from file: Threat Hunting - MDE Network Intrusion Discovery
KQL Query
KQL Query from file: Internet facing devices vulnerablility report
KQL Query
KQL Query from file: Hunting CVE-2025-31324
KQL Query from file: Critical Vulnerability in Elastic Kibana
Looking for high volume queries against a given RemoteIP, per DeviceName, RemotePort and Process.
Please change the Timestamp window according your preference/objective, as also the subnet ranges that you want to analyze against.
Please change the Timestamp window according your preference/objective, as also the subnet ranges that you want to analyze against.
