Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
89 detections
Filters
Last updated
All Time
Detection languages
48
10
7
6
5
Contributors
24
20
12
6
4
Categories
24
21
20
18
17
Platforms
46
27
17
17
7
Products / Services
24
10
10
7
6
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
1
IDS Classtypes
5
3
1
1
IDS Protocols
4
3
2
1
This rule detects potential information disclosure attempts by monitoring W3C IIS logs for repeated queries containing keywords like 'version', 'build', or 'debug'. A high frequency (5 or more attempts within an hour) from a single IP address suggests an adversary is trying to enumerate software versions or debug information, which can be used for further reconnaissance or exploit development.
This rule detects potential reconnaissance activity by identifying IP addresses that generate a high volume of HTTP requests with user agents indicating bots, crawlers, or scanners. It counts requests per IP address within one-hour bins and flags those with 50 or more such requests.
HTTP Server Banner Grabbing
Suricata
This rule detects HTTP server banner grabbing activity. Specifically, it triggers when a client sends a 'HEAD' HTTP request to a server on port 80, and this activity occurs at a high frequency (20 times within 30 seconds from the same source IP). Banner grabbing is a reconnaissance technique used to identify the type and version of web servers, which can then be used to find known vulnerabilities.
This rule detects SSH banner grabbing attempts by monitoring TCP traffic to port 22 (SSH) on the home network. It specifically looks for the string "SSH-" within the first 4 bytes of the payload, indicating an attempt to identify the SSH server version. A threshold of 10 such events from the same source within 60 seconds will trigger an alert, classifying it as a network scan.
TLS Certificate Harvesting Sweep
Suricata
This rule detects a TLS certificate harvesting sweep, characterized by a high volume of TLS Server Name Indication (SNI) requests from a single source within a short period. This behavior is indicative of reconnaissance activities where an attacker is attempting to collect information about services running on various hosts by observing their TLS certificates.
HTTPS Server Banner Grabbing
Suricata
This rule detects HTTPS server banner grabbing attempts. It triggers an alert when a client sends 20 or more 'HEAD' HTTP requests to an HTTPS server on port 443 within a 30-second window, indicating an attempt to gather information about the server.
This rule detects attempts to enumerate SNMP community strings by looking for UDP traffic on port 161 containing the string "public" (case-insensitive). It uses a threshold of 10 occurrences within 30 seconds from the same source IP to identify potential scanning activity.
Detects the execution of the prt-scan supply chain campaign payload by identifying specific hardcoded exfiltration and reconnaissance log markers in command line arguments. These markers include 'PRT_EXFIL', 'PRT_RECON', 'PRT_HARVEST', 'PRT_DELAYED', 'PRT_GIT_AUTH', and 'PRT_LABEL_BYPASS'.
AWS SES Email Enumeration Detection
Cortex XDR
Detects enumeration of AWS SES email identities and sending quotas. This activity can indicate an attacker performing reconnaissance before launching phishing or Business Email Compromise (BEC) attacks. The rule identifies multiple distinct SES operations related to identity and quota checks performed by a single user within a two-hour window.
Detects a sequence of system reconnaissance commands followed by data exfiltration to temp.sh, a TTP used in the Notepad++ supply chain attack.
This rule aimed to detect NetSupport RAT via MSIX app installer files. Attackers use csvde.exe to collect target device informations such as ip and accountname. They put outputs to the file (-f). And then send it to the attacker.
This rule identifies a source IP address that is triggering a variety of Akamai WAF rules across multiple hosts, which is indicative of broad scanning or reconnaissance activity. It aggregates events by source IP within 30-minute windows, counting distinct WAF rules and hosts targeted. The rule then applies thresholds to identify suspicious behavior, specifically looking for an IP that triggers more than 5 distinct WAF rules, targets more than 2 distinct hosts, and generates over 10 denied events.
The following analytic detects suspicious PowerShell activity via EventCode 4104, where WMI performs event queries to gather information on running processes or services. This detection leverages PowerShell Script Block Logging to identify specific WMI queries targeting system information classes like Win32_Bios and Win32_OperatingSystem. This activity is significant as it often indicates reconnaissance efforts by an adversary to profile the compromised machine. If confirmed malicious, the attacker could gain detailed system information, aiding in further exploitation or lateral movement within the network.
Hunting WMI execution from remote system
This rule detects suspicious PowerShell script execution that attempts to identify installed anti-virus products using WMI or PowerShell commands. It specifically looks for PowerShell Script Block Logging (EventCode 4104) entries containing keywords like "SELECT," "WMIC," "AntiVirusProduct," or "AntiSpywareProduct." This activity is often performed by malware and APT actors to map security applications for evasion purposes, potentially leading to the disabling or bypassing of security measures.
KQL Query from file: Detect Microsoft Graph API Abuse
KQL Query from file: Threat Intelligence Data from Sentinel UEBA
KQL Query
This analytic identifies suspicious PowerShell script execution via EventCode 4104, where WMI performs an event query to list running processes or services. This detection leverages PowerShell Script Block Logging to capture and analyze script block text for specific WMI queries. This activity is significant as it is commonly used by malware and APT actors to map security applications or services on a compromised machine. If confirmed malicious, this could allow attackers to identify and potentially disable security defenses, facilitating further compromise and persistence within the environment.
'Any Alerts that fired on any host with this same process in the range of +-1d'
This query provides the most common services discovered
Page 4 of 5