Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20 detections
Filters
Last updated
All Time
Detection languages
10
4
3
3
Contributors
8
4
2
2
1
Categories
15
12
5
3
1
Platforms
10
7
3
Products / Services
6
6
4
4
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
Detects anomalous network connection enumeration activities associated with JFMBackdoor, where a DLL sideloaded into the legitimate Windows fltMC.exe utility spawns netstat.exe to perform discovery of active network connections on the compromised system.
Detects execution of 'netstat.exe' with specific flags ('-a', '-n', '-o', or '-b') initiated by command-line interpreters like cmd.exe, powershell.exe, wscript.exe, or cscript.exe. These flags are commonly used for network reconnaissance and discovery of active TCP connections, listening ports, and associated process IDs.
Detects execution of 'netstat.exe' with specific flags ('-a', '-n', '-o', or '-b') initiated by command-line interpreters like cmd.exe, powershell.exe, wscript.exe, or cscript.exe. These flags are commonly used for network reconnaissance and discovery of active TCP connections, listening ports, and associated process IDs.
Detects activity related to Network Discovery.
Here, one group of network commands has to match for the rule to trigger.
Here, one group of network commands has to match for the rule to trigger.
Detects potential remote code execution associated with the exploitation of Oracle E-Business Suite vulnerability CVE-2025-61882 on Windows hosts. The rule looks for a Java process spawning a command shell to execute reconnaissance commands, followed by an outbound network connection from the same Java process within a short time frame. This behavior is consistent with post-exploitation activity observed in the campaign.
Detects the execution of NetCat (nc) on macOS systems. NetCat is a versatile networking utility that can be used for various purposes, including port scanning, banner grabbing, file transfers, and creating backdoors. This rule specifically looks for process creation events where the process name is 'nc' and excludes known legitimate uses by 'Jamf Connect' and 'TruU Authenticator', as well as a specific health check script.
Use this query to find reconnaissance and beaconing activities after code injection occurs.
Reconnaissance commands are consistent with the current version of Qakbot and occur automatically to exfiltrate system information. This data, once exfiltrated, will be used to prioritize human operated actions.
Reconnaissance commands are consistent with the current version of Qakbot and occur automatically to exfiltrate system information. This data, once exfiltrated, will be used to prioritize human operated actions.
This query was originally published in the threat analytics report, SQL Server abuse.
SQL Server offers a vast array of tools for automating tasks, exporting data, and running scripts. These legitimate tools can be repurposed by attackers. Because there are so many powerful commands an attacker might exploit, hunting for malicious activity involving SQL Server can be complicated.
This query detects instances of a SQL Server process launching a shell to run one or more suspicious commands.
Reference - https://docs.microsoft.com/sql/relational-databases/security/securing-sql-server?view=sql-server-ver15
SQL Server offers a vast array of tools for automating tasks, exporting data, and running scripts. These legitimate tools can be repurposed by attackers. Because there are so many powerful commands an attacker might exploit, hunting for malicious activity involving SQL Server can be complicated.
This query detects instances of a SQL Server process launching a shell to run one or more suspicious commands.
Reference - https://docs.microsoft.com/sql/relational-databases/security/securing-sql-server?view=sql-server-ver15
The following analytic identifies instances where `ipconfig.exe`, `systeminfo.exe`, or similar tools are executed by a non-standard shell parent process, excluding CMD, PowerShell, or Explorer. This detection leverages Endpoint Detection and Response (EDR) telemetry to monitor process creation events. Such behavior is significant as it may indicate adversaries using injected processes to perform system discovery, a tactic observed in FIN7's JSSLoader. If confirmed malicious, this activity could allow attackers to gather critical host information, aiding in further exploitation or lateral movement within the network.
The following analytic detects suspicious system network configuration discovery activities, which may indicate an adversary's attempt to gather information about the network environment. Such actions typically involve commands or tools used to identify network interfaces, routing tables, and active connections. Detecting these activities is crucial, as they often precede more targeted attacks like lateral movement or data exfiltration. By identifying unusual or unauthorized network discovery efforts, this analytic helps security teams to swiftly detect and respond to potential reconnaissance operations, mitigating the risk of further compromise.
The analytic detects the execution of `netstat.exe` with command-line arguments to list network connections on a system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, command-line executions, and parent processes. This activity is significant as both Red Teams and adversaries use `netstat.exe` for situational awareness and Active Directory discovery. If confirmed malicious, this behavior could allow attackers to map network connections, identify critical systems, and plan further lateral movement or data exfiltration.
The analytic identifies potential enumeration of local network configuration on Linux systems. It detects this activity by monitoring processes such as "arp," "ifconfig," "ip," "netstat," "firewall-cmd," "ufw," "iptables," "ss," and "route" within a 30-minute window. This behavior is significant as it often indicates reconnaissance efforts by adversaries to gather network information for subsequent attacks. If confirmed malicious, this activity could enable attackers to map the network, identify vulnerabilities, and plan further exploitation or lateral movement within the environment.
Detects the execution of common macOS command-line utilities used for enumerating local network configuration and firewall settings. This includes tools like 'arp', 'ifconfig', 'netstat', 'networksetup', and 'socketfilterfw', as well as 'defaults' when querying specific firewall preferences.
Detects the installation of suspicious packages using common Linux package managers (apt, yum, rpm, dpkg). The rule specifically looks for keywords associated with network scanning, sniffing, and proxy tools, which could indicate reconnaissance, network analysis, or attempts to bypass network controls by an adversary.
Detects the execution of Netcat (nc.exe, ncat.exe, netcat.exe) with suspicious command-line arguments often associated with establishing listener modes, reverse shells, or proxy connections. Netcat is a versatile networking utility that can be used by adversaries for command and control (C2) communication, data exfiltration, or creating backdoors, often leveraging non-application layer protocols.
This rule detects suspicious sub-processes spawned by common web server processes on Linux systems. It specifically looks for web server processes (Apache, Nginx, Lighttpd, Node, Caddy, Tomcat, WebSphere) executing common system utilities and commands such as 'whoami', 'ifconfig', 'ip', 'uname', 'cat', 'crontab', 'hostname', 'iptables', 'netstat', 'pwd', and 'route'. This behavior is indicative of a web shell being used to execute commands on the compromised server.
This rule detects attempts to enumerate local network configuration on Linux systems. It specifically looks for the execution of common network utilities such as 'firewall-cmd', 'ufw', 'iptables', 'netstat', 'ss', 'ip', 'ifconfig', 'systemd-resolve', and 'route'. Additionally, it triggers if '/etc/resolv.conf' is present in the command line, indicating an attempt to inspect DNS resolver configuration.
Detects the execution of common network scanning or service enumeration tools like telnet, nmap, and netcat on Linux systems, as captured by auditd logs. This activity can indicate an adversary attempting to discover local or remote network services.
Detects various process execution behaviors associated with the Lazarus Group, including attempts to dump SAM registry hive, network connection enumeration using netstat, network share discovery patterns, persistence mechanisms involving common program data directories, and rundll32 execution with specific file extensions.
Detects the execution of system utilities commonly used on macOS to discover network connections and logged-in users. These utilities include 'who', 'w', 'last', 'lsof', and 'netstat'. Adversaries may use these commands during the discovery phase to understand the network environment and identify potential targets or communication paths.