Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
36 detections
Filters
Last updated
All Time
Detection languages
17
9
6
2
1
Contributors
12
4
3
3
3
Categories
10
9
9
8
6
Platforms
19
11
5
5
3
Products / Services
9
6
4
4
4
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
4
3
2
IDS Protocols
4
4
1
This rule detects a DNS reverse lookup sweep, which is characterized by a high volume of DNS queries for reverse IP addresses (in-addr.arpa) within a short period. Specifically, it triggers an alert if 20 such queries are observed from a single source IP within 30 seconds. This activity is often indicative of reconnaissance efforts by an attacker to map out internal network infrastructure.
Detects queries to IP lookup services used by FlexibleFerret for victim identification.
Detects outbound HTTP GET requests consistent with Lumma Stealer's browser fingerprinting activity. This activity involves contacting a C2 endpoint at '/api/set_agent' with specific URL parameters ('id', 'token', 'description') to register the victim and gather system information.
This rule detects inbound HTTP requests containing the User-Agent string 'Salesforce-CLI/1.0'. This activity is considered suspicious as it may indicate reconnaissance or data theft attempts targeting Salesforce instances, potentially leveraging compromised credentials or systems. The presence of this specific User-Agent inbound to a network could be an indicator of malicious activity, as Salesforce CLI is typically used by developers and administrators for managing Salesforce organizations and is not expected to be seen in inbound traffic from external networks to internal systems.
This rule identifies a source IP address that is triggering a variety of Akamai WAF rules across multiple hosts, which is indicative of broad scanning or reconnaissance activity. It aggregates events by source IP within 30-minute windows, counting distinct WAF rules and hosts targeted. The rule then applies thresholds to identify suspicious behavior, specifically looking for an IP that triggers more than 5 distinct WAF rules, targets more than 2 distinct hosts, and generates over 10 denied events.
Identifies devices that have been observed as being directly exposed to the public internet. This is based on Microsoft Defender for Endpoint's device discovery capabilities. Such devices may be at higher risk of attack and should be reviewed to ensure the exposure is intentional and properly secured.
KQL Query from file: Detect Microsoft Graph API Abuse
KQL Query from file: Detecting EXO MS Graph Enumeration Attacks
KQL Query from file: Honeypot Threat Intelligence (TI) Data
Detects DNS queries for IP lookup services such as "api.ipify.org" originating from a non browser process.
This query uncovers seen IPAddressV6 network subnets
Detects update checks performed by Advanced IP Scanner and Advanced Port Scanner utilities. These utilities are often used for network reconnaissance and can be considered Potentially Unwanted Applications (PUA) in some environments. The rule specifically looks for requests to '/checkupdate.php' with a set of specific query parameters, indicating an update check from these tools.
Detect the update check performed by Advanced IP/Port Scanner utilities.
Detects DNS queries for IP lookup services such as "api.ipify.org" originating from a non-browser process. This behavior can indicate reconnaissance activity by malware or an attacker attempting to determine the external IP address of a compromised system.
Detects DNS queries for IP lookup services such as "api.ipify.org" originating from a non browser process.
Page 2 of 2