Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
363 detections
Filters
Last updated
All Time
Detection languages
167
84
32
27
19
Contributors
72
68
54
38
18
Categories
201
123
98
78
62
Platforms
215
118
97
39
7
Products / Services
76
69
48
32
25
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
5
2
2
2
1
IDS Classtypes
28
4
1
IDS Protocols
23
6
1
1
This rule detects potential port scanning activity from a single host. It identifies scenarios where a device attempts to connect to a large number of unique remote ports (20 or more) or a large number of unique remote IP addresses (25 or more) within a 10-minute window. This behavior is indicative of an adversary attempting to discover open ports or active hosts on a network.
Detects a device making an unusually high number of unique outbound network connections to different remote IP addresses within a short time frame (5 minutes). This behavior can indicate various malicious activities such as network scanning, botnet activity, or data exfiltration to multiple external hosts.
Detects a Python process initiating outbound network connections to common administrative and remote access ports (135, 445, 3389). This activity is indicative of the internal port scanning phase used by UNC6692 prior to lateral movement in their SNOW ecosystem deployment.
This rule identifies potential network scanning or high-volume communication by detecting a large number of connections (50 or more) between a single source IP and a single destination IP within a 5-minute time window. It aggregates connection details such as total connections, sent bytes, and received bytes from the CommonSecurityLog.
This rule detects potential internal network scanning activity by identifying a single source IP address that communicates with 15 or more distinct internal destination IP addresses within a 5-minute time window. This behavior is often indicative of reconnaissance efforts by an attacker attempting to map out the internal network.
This rule detects potential network port scanning activity by identifying a single source IP address attempting to connect to 10 or more distinct destination ports on a single destination IP address within a 5-minute window. This behavior is indicative of an attacker attempting to discover open services on a target host.
Requires Defender DeviceNetworkEvents table
Group together attempted connections from single remote IPs and bin them into time intervals. For each remote IP series find a best fit line and extend the slope measure. Using the slope attribute display the outliers.
Varying the timespan does change the results, long timespans will only display very noisy port scans whereas short timespans tend to produce more false positives.
Group together attempted connections from single remote IPs and bin them into time intervals. For each remote IP series find a best fit line and extend the slope measure. Using the slope attribute display the outliers.
Varying the timespan does change the results, long timespans will only display very noisy port scans whereas short timespans tend to produce more false positives.
Detects instances where an OpenCanary node has been targeted by a NMAP FIN Scan
Detects instances where an OpenCanary node has been targeted by a NMAP NULL Scan
Detects instances where an OpenCanary node has been targeted by a NMAP OS Scan
Detects instances where an OpenCanary node has been targeted by a NMAP XMAS Scan
Detects instances where an OpenCanary node has been targeted by a SYN port scan.
This rule detects potential port scanning activity from a single host. It identifies scenarios where a device attempts to connect to a large number of unique remote ports (20 or more) or a large number of unique remote IP addresses (25 or more) within a 10-minute window. This behavior is indicative of an adversary attempting to discover open ports or active hosts on a network.
This rule detects the execution of multiple common network discovery commands within a short time frame. This behavior can indicate reconnaissance activities aimed at understanding network topology, identifying active hosts, and discovering network services.
Detects the DKnife gateway-monitoring framework, a toolset used by China-nexus actors for adversary-in-the-middle (AitM) attacks, based on specific file, network, and persistence artifacts.
Detects DKnife attempting to discover network information by sending a POST request with a specific password hash to a router management interface. This activity is associated with the DKnife framework, a China-nexus gateway-monitoring tool.
This rule detects activities associated with the EtherRAT self-propagating worm, specifically its module for scanning and exploiting vulnerable Next.js applications. It looks for combinations of mass port scanning tools (nmap, masscan, zmap, nc) targeting common web ports, logging of Next.js scan activities, `curl` commands with specific `Next-Action` headers indicative of Next.js exploitation, `node` or `nodejs` processes performing network connections to private IP ranges, and command lines containing patterns related to prototype pollution exploitation (e.g., `__proto__`, `constructor.prototype`). The rule correlates these activities to identify potential exploitation attempts against Next.js applications using the React2Shell vulnerability (CVE-2025-55182) and subsequent lateral movement or payload delivery.
Detects high-volume vulnerability and spyware threat activity originating from external (UNTRUSTED) sources targeting public-facing IP addresses.
This detection identifies potential exploitation attempts, scanning activity, and malicious payload delivery by monitoring PAN-OS threat logs where severity is not informational and the subtype indicates vulnerability or spyware.
The rule triggers when:
A source IP generates ≥100 reset-both actions within 1 hour (indicative of blocked exploit or aggressive scanning), or
A source IP generates ≥10 non-reset actions within 1 hour (indicative of potentially successful or partially successful attempts)
Enrichment includes ASN, country, organization, and city to support attribution, threat hunting, and blocking decisions.
This detection identifies potential exploitation attempts, scanning activity, and malicious payload delivery by monitoring PAN-OS threat logs where severity is not informational and the subtype indicates vulnerability or spyware.
The rule triggers when:
A source IP generates ≥100 reset-both actions within 1 hour (indicative of blocked exploit or aggressive scanning), or
A source IP generates ≥10 non-reset actions within 1 hour (indicative of potentially successful or partially successful attempts)
Enrichment includes ASN, country, organization, and city to support attribution, threat hunting, and blocking decisions.
Detects enumeration of local or remote network services.
Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.
Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.
Page 13 of 18