Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
363 detections
Filters
Last updated
All Time
Detection languages
167
84
32
27
19
Contributors
72
68
54
38
18
Categories
201
123
98
78
62
Platforms
215
118
97
39
7
Products / Services
76
69
48
32
25
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
5
2
2
2
1
IDS Classtypes
28
4
1
IDS Protocols
23
6
1
1
Detects a Python process initiating a network connection. While this often relates to package installation, it can also indicate a potential malicious script communicating with a C&C server.
Detects the use of Advanced Port Scanner.
Detects a Python process initiating a network connection. While this often relates to package installation, it can also indicate a potential malicious script communicating with a C&C server.
Detects the use of Advanced Port Scanner.
This query uncovers seen IPAddressV4 network subnets
Use this query to locate injected processes launching discovery activity. Qakbot has been observed leading to ransomware in numerous instances.
Detects usage of NimScan, a portscanner utility.
In early 2025, adversaries were observed using this utility to scan for open ports on remote hosts in a compromised environment.
This rule identifies the execution of NimScan based on the process image name and specific hash values associated with different versions of the tool.
In early 2025, adversaries were observed using this utility to scan for open ports on remote hosts in a compromised environment.
This rule identifies the execution of NimScan based on the process image name and specific hash values associated with different versions of the tool.
WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz
Microsoft has observed threat actors exploiting vulnerabilities associated with Log4J.
Detects usage of NimScan, a portscanner utility.
In early 2025, adversaries were observed using this utility to scan for open ports on remote hosts in a compromised environment.
This rule identifies the execution of NimScan based on the process image name and specific hash values associated with different versions of the tool.
In early 2025, adversaries were observed using this utility to scan for open ports on remote hosts in a compromised environment.
This rule identifies the execution of NimScan based on the process image name and specific hash values associated with different versions of the tool.
WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz
Find devices connected to a monitored network.
Please Note line 5 needs to have a monitored network name put in place or commented out to pull everything.
Please Note line 5 needs to have a monitored network name put in place or commented out to pull everything.
Looking for high volume queries against a given RemoteIP, per DeviceName, RemotePort and Process.
Please change the Timestamp window according your preference/objective, as also the subnet ranges that you want to analyze against.
Please change the Timestamp window according your preference/objective, as also the subnet ranges that you want to analyze against.
Dragon Fly
KQL
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_dragonfly.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
This query uncovers seen IPAddressV6 network subnets
This query was originally published in the threat analytics report, Operation Soft Cell.
Operation Soft Cell is a series of campaigns targeting users' call logs at telecommunications providers throughout the world. These attacks date from as early as 2012.
Operation Soft Cell operators have been known to run nbtscan.exe, a legitimate MS-DOS command-line tool used to discover any NETBIOS nameservers on a local or remote TCP/IP network.
The following query detects any nbtscan activity on the system over the past seven days.
Reference - https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers
Operation Soft Cell is a series of campaigns targeting users' call logs at telecommunications providers throughout the world. These attacks date from as early as 2012.
Operation Soft Cell operators have been known to run nbtscan.exe, a legitimate MS-DOS command-line tool used to discover any NETBIOS nameservers on a local or remote TCP/IP network.
The following query detects any nbtscan activity on the system over the past seven days.
Reference - https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers
This query surfaces devices that are in a specific IPAddressV6 subnet
Detects remote RPC calls to get event log information via the EVEN or EVEN6 interfaces, which can be indicative of reconnaissance activity by an attacker. This rule specifically targets RPC Firewall logs for these interface UUIDs.
This rule detects remote RPC calls made to query information about scheduled tasks. Specifically, it monitors for RPC Firewall events (EventID 3) with a specific InterfaceUuid (86d35949-83c9-4044-b424-db363231fd0c) which corresponds to the ITaskSchedulerService. The rule filters out common operational numbers (OpNum 1, 3, 4, 10, 11, 12, 13, 14, 15) to reduce false positives, focusing on less common or potentially malicious reconnaissance activities related to scheduled tasks.
Detects an attempt to leverage dnscmd.exe to enumerate DNS zones or records of a domain. This activity can be indicative of reconnaissance by an attacker.
This analytic detects internal hosts triggering multiple IDS signatures, which may include either more than 25 signatures against a single host or a single signature across over 25 destination IP addresses. Such patterns can indicate active vulnerability scanning activities within the network. By monitoring IDS logs, this detection helps identify and respond to potential vulnerability scanning attempts, enhancing the network's security posture and preventing potential exploits.
Page 16 of 18