Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
363 detections
Filters
Last updated
All Time
Detection languages
167
84
32
27
19
Contributors
72
68
54
38
18
Categories
201
123
98
78
62
Platforms
215
118
97
39
7
Products / Services
76
69
48
32
25
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
5
2
2
2
1
IDS Classtypes
28
4
1
IDS Protocols
23
6
1
1
Detects the use of Advanced Port Scanner.
Detects authentication and Office activity where User-Agent strings match known malicious, reconnaissance, scanning, or C2 tool fingerprints. Helps identify automated attacks, credential stuffing, and adversary tooling.
This analytic detects instances where an internal host attempts to communicate with over 500 ports on a single destination IP address. It includes filtering criteria to exclude applications performing scans over ephemeral port ranges, focusing on potential reconnaissance or scanning activities. Monitoring network traffic logs allows for timely detection and response to such behavior, enhancing network security by identifying and mitigating potential threats promptly.
KQL Query from file: Endpoint SMB Exposed on Public Internet
This rule detects potential malware infections and command and control activity by correlating email, endpoint file, and network events with indicators of compromise (IOCs) sourced from an external OSINT feed. It specifically looks for SHA256 hashes in email attachments, domains and URLs in email links, MD5, SHA1, and SHA256 hashes of created files on endpoints, and IP addresses and domains in network connections (both direct and HTTP inspected connections). The rule aims to identify initial access, execution, and command and control phases of an attack, potentially involving Cloudflare Tunnels as suggested by the rule's title and the OSINT source.
Port scanning is a common precursor to ransomware attacks, typically occurring during the reconnaissance phase. With Entra Global Secure Access deployed across your endpoints for zero-trust access, you can leverage KQL to detect port scan activity indicative of early-stage threat behavior.
This KQL Query is oriented to extract the different bits of TCP Flags which helps to review the different state of the connections and identify possible threats associated.
In addition, it allows to filter by specific TCP Flag to detect specific threats based on every case.
In addition, it allows to filter by specific TCP Flag to detect specific threats based on every case.
Detects scenarios where an attacker would attempt to enumerate hosts resources and execute a payload with a compromised account. Vulnerability scanners, enumeration software or tool like SharepHound/CrackMapexec may generate such behavior.
Detects scenarios where an attacker would attempt to enumerate hosts and collect relevant information using anonymous access. Vulnerability scanners, enumeration software or tool like CrackMapexec may generate such behavior.
Detects scenarios where a suspicious anonymous login is performed during discovery phases.
This KQL query detects network traffic to or from suspicious ports by joining firewall logs (CommonSecurityLog) with an external, regularly updated list of known suspicious ports. It specifically looks for accepted or passed connections to these ports, indicating potential exploitation attempts or unauthorized communication channels used by threat actors.
This analytic identifies instances where an internal host has attempted to communicate with 250 or more destination IP addresses using the same port and protocol. Horizontal port scans from internal hosts can indicate reconnaissance or scanning activities, potentially signaling malicious intent or misconfiguration. By monitoring network traffic logs, this detection helps detect and respond to such behavior promptly, enhancing network security and preventing potential threats.
This analytic identifies instances where an internal host has attempted to communicate with 250 or more destination IP addresses using one of the NMAP top 20 ports. Horizontal port scans from internal hosts can indicate reconnaissance or scanning activities, potentially signaling malicious intent or misconfiguration. By monitoring network traffic logs, this detection helps detect and respond to such behavior promptly, enhancing network security and preventing potential threats.
This hunting query detects potential abuse of the MS-RPC protocol for DoS/DDoS attacks by monitoring outbound LDAP-related DNS queries originating from Domain Controllers.
It is inspired by the SafeBreach “Win-DOS Epidemic” research, which revealed a technique where attackers abuse RPC calls to trigger massive LDAP query floods. The query flags high-volume _ldap queries to external (non-private) IPs, with extra scrutiny on processes like lsass.exe and svchost.exe that, if abused, may indicate system-level compromise or protocol exploitation.
The detection is filtered to DC naming conventions (DC*) to reduce false positives and maintain high fidelity.
Stage 1 logic integrated from SlimKQL.
It is inspired by the SafeBreach “Win-DOS Epidemic” research, which revealed a technique where attackers abuse RPC calls to trigger massive LDAP query floods. The query flags high-volume _ldap queries to external (non-private) IPs, with extra scrutiny on processes like lsass.exe and svchost.exe that, if abused, may indicate system-level compromise or protocol exploitation.
The detection is filtered to DC naming conventions (DC*) to reduce false positives and maintain high fidelity.
Stage 1 logic integrated from SlimKQL.
This detection identifies potential usage of the Naabu port scanner by searching for its process execution or its specific network user-agent string. Naabu is a fast port scanner that can be used for network reconnaissance.
This analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. It leverages Cisco Secure Firewall Threat Defense logs and identifies connections where the action is set to Block, and the number of occurrences reaches or exceeds a threshold of ten within a one-minute span. This pattern may indicate a misconfigured application, unauthorized access attempts, or early stages of a brute-force or scanning operation. If confirmed malicious, this behavior may represent an attacker probing the network, attempting lateral movement, or testing firewall rules for weaknesses.
The following analytic detects a blocked connection event by identifying a "Block" value in the action field. It leverages logs from Cisco Secure Firewall Threat Defense devices. This activity is significant as it can identify attempts from users or applications initiating network connection to explicitly or implicitly blocked range or zones. If confirmed malicious, attackers could be attempting to perform a forbidden action on the network such as data exfiltration, lateral movement, or network disruption.
Detects post-exploitation techniques used by the GoldMelody Initial Access Broker (also tracked as TGR-CRI-0045 and UNC961). This activity includes the use of a specific staging directory 'C:\Windows\Temp\111t' for custom tooling like 'updf.exe' for privilege escalation and 'txp.exe'/'txpm.exe' for port scanning.
KQL Query from file: Sentinel All-In-One IP ThreatHunt
KQL Query from file: External Attack Surface Monitoring KQL
KQL Query from file: Multi-Cloud DefenderXDR KQL Threat Detection
Page 14 of 18