Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
228 detections
Filters
Last updated
All Time
Detection languages
125
51
16
16
14
Contributors
76
43
23
17
14
Categories
97
93
71
65
41
Platforms
111
82
39
28
16
Products / Services
47
46
42
36
36
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
4
3
3
2
2
IDS Classtypes
39
7
3
2
IDS Protocols
24
23
3
1
KQL Query
KQL Query
KQL Query
KQL Query
KQL Query
KQL Query from file: Perimeter Defense - Attack Surface Reduction
KQL Query from file: Internet facing devices vulnerablility report
KQL Query from file: CVE-2024-26234 and CVE-2024-29988
KQL Query from file: Exposure Management - Slim's Metric (MaxCVSS-DAW)
KQL Query from file: CVE-2024-3094 with CVSS Score 10
KQL Query from file: Honeypot Threat Intelligence (TI) Data
KQL Query
KQL Query
KQL Query from file: Critical Vulnerability in Elastic Kibana
This detection targets suspicious ROPC (Resource Owner Password Credentials) authentication attempts involving brute-forcing of application client IDs, specifically related to the `Invoke-BruteClientIDs` function in MFA Sweep. This function can be used for enumerating gaps in MFA and/or CA policies, in addition to password validation via credential stuffing.
KQL Query from file: Detect CVE-2024-31497
'Discover all critical ports from a list having rules like 'Any' for sourceIp, which means that they are opened to everyone. Critial ports should not be opened to everyone, and should be filtered.'
Microsoft has observed attackers exploiting vulnerabilities associated with Log4J.
Search for the CVEs that should be prioritized and resolved to reduce the success of the FireEye Red Team tools compromised by the Nobelium activity group.
See red_team_tool_countermeasures on the official FireEye repo.
References:
https://github.com/fireeye/red_team_tool_countermeasures/blob/master/CVEs_red_team_tools.md
https://github.com/fireeye
See red_team_tool_countermeasures on the official FireEye repo.
References:
https://github.com/fireeye/red_team_tool_countermeasures/blob/master/CVEs_red_team_tools.md
https://github.com/fireeye
'Identifies when 30 or more ports are used for a given client IP in 10 minutes occurring on the IIS server.
This could be indicative of attempted port scanning or exploit attempt at internet facing web applications.
This could also simply indicate a misconfigured service or device.
References:
IIS status code mapping - https://support.microsoft.com/help/943891/the-http-status-code-in-iis-7-0-iis-7-5-and-iis-8-0
Win32 Status code mapping - https://msdn.microsoft.com/library/cc231199.aspx'
This could be indicative of attempted port scanning or exploit attempt at internet facing web applications.
This could also simply indicate a misconfigured service or device.
References:
IIS status code mapping - https://support.microsoft.com/help/943891/the-http-status-code-in-iis-7-0-iis-7-5-and-iis-8-0
Win32 Status code mapping - https://msdn.microsoft.com/library/cc231199.aspx'
'Detects suspicious user agent strings used by known hack tools'
Page 10 of 11