Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
228 detections
Filters
Last updated
All Time
Detection languages
125
51
16
16
14
Contributors
76
43
23
17
14
Categories
97
93
71
65
41
Platforms
111
82
39
28
16
Products / Services
47
46
42
36
36
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
4
3
3
2
2
IDS Classtypes
39
7
3
2
IDS Protocols
24
23
3
1
This rule detects potential vulnerability scanning activity by identifying devices making multiple successful network connections to specific ports commonly used by vulnerability scanners (8834, 8889, 1241). A device is flagged if it makes 3 or more such connections within a one-hour window.
Detects the creation of files containing keywords such as 'vulnerability', 'assessment', or 'scan'. This rule aims to identify activities related to vulnerability scanning or security assessments being performed on a system, potentially indicating reconnaissance or unauthorized activity. The events are summarized by the initiating process account name and time to help identify the source of these activities.
This rule detects HTTP traffic where the User-Agent header contains the string "Burp" (case-insensitive). This is indicative of traffic generated by Burp Suite, a popular web vulnerability scanner and proxy tool. The rule specifically looks for traffic flowing from the internal network to a server.
This rule detects the use of the SQLMap automated SQL injection tool by identifying the string "sqlmap" in the HTTP User-Agent header of network traffic. It specifically looks for traffic flowing to the server on established connections.
This rule detects network reconnaissance activity by identifying HTTP requests where the User-Agent header contains the string "masscan". Masscan is a fast internet port scanner, and its User-Agent string often indicates scanning activity, which aligns with the MITRE ATT&CK technique T1595.002 for active scanning during reconnaissance.
Detects HTTP requests with known scanner or automation user-agents commonly used by reconnaissance tools like Nikto, sqlmap, or curl-based scripts. This rule specifically looks for 'sqlmap', 'nikto', 'curl', and 'python-requests' within the HTTP User-Agent header.
This rule detects network reconnaissance activity by identifying HTTP user-agent strings commonly associated with vulnerability scanners like Nmap or Masscan. It specifically looks for the string 'Nmap' within the HTTP user-agent header in traffic flowing from the internal network to a server.
This rule identifies 'chokepoint' devices within an environment based on their high number of inbound and outbound connections (at least 2 each). It then enriches these chokepoint devices with vulnerability and misconfiguration remediation recommendations from Microsoft Defender for Endpoint (MDE) TVM and Exposure Graph. The rule prioritizes remediation based on the calculated 'ChokepointScore' (InboundCount * OutboundCount) and indicates if the device has active exploits. This helps security teams focus remediation efforts on critical assets that could significantly impact the network if compromised.
Suspicious PAN-OS Captive Portal Access
Cortex XDR
Detects anomalous or repetitive access to PAN-OS Captive Portal HTTP endpoints which may indicate active scanning for CVE-2026-0300 vulnerability exposure.
CVE-2026-0300 Scanner Tool User-Agent
Cortex XDR
Detects the use of the CVE-2026-0300 scanner tool by its distinct User-Agent string attempting to identify vulnerable PAN-OS Captive Portals.
This rule detects potential network reconnaissance activity by looking for keywords such as 'scan', 'sweep', 'probe', 'recon', 'nmap', and 'nessus' within the 'Message' field of CommonSecurityLog entries. This could indicate an adversary actively gathering information about the network infrastructure.
Detects User-Agent rotation behavior from a single Source IP (c-ip) associated with more than 3 distinct
User-Agent (c-useragent) values within a 5-minute window. This behavior is characteristic of the Nuclei
'-random-agent' flag, which allows the scanner to bypass WAF (Web Application Firewall) detections by
using a different, valid browser User-Agent string for each request.
User-Agent (c-useragent) values within a 5-minute window. This behavior is characteristic of the Nuclei
'-random-agent' flag, which allows the scanner to bypass WAF (Web Application Firewall) detections by
using a different, valid browser User-Agent string for each request.
This rule identifies Cisco network devices within Microsoft Defender for Endpoint (MDE) telemetry that are running Cisco IOS or Cisco XE operating systems, excluding version '17.15.4a'. The exclusion of a specific OS version suggests the rule is designed to pinpoint devices that may be vulnerable to a known security flaw, potentially CVE-2025-20352 as indicated by the rule's title. It helps in mapping exposure to specific vulnerabilities by identifying potentially unpatched or vulnerable network infrastructure components.
Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string and performs GET requests. This activity is indicative of reconnaissance or data scraping.
This query identifies Linux devices with vulnerable versions of the Common Unix Printing System (CUPS) installed, which are susceptible to remote denial-of-service and authentication bypass attacks as described in CVE-2025-58364 and CVE-2025-58060. The rule filters for CUPS software packages on Linux systems and compares the installed version against a known vulnerable version cutoff. This cutoff is a placeholder and must be updated with specific version information from official vendor advisories.
This rule identifies devices that are missing recommended security updates based on data from Microsoft Defender for Endpoint's TVM (Threat and Vulnerability Management) capabilities. It joins vulnerability information with knowledge base articles to pinpoint specific missing updates.
This rule identifies a source IP address that is triggering a variety of Akamai WAF rules across multiple hosts, which is indicative of broad scanning or reconnaissance activity. It aggregates events by source IP within 30-minute windows, counting distinct WAF rules and hosts targeted. The rule then applies thresholds to identify suspicious behavior, specifically looking for an IP that triggers more than 5 distinct WAF rules, targets more than 2 distinct hosts, and generates over 10 denied events.
This rule detects attempts at Local File Inclusion (LFI) or Remote File Inclusion (RFI) vulnerabilities by analyzing web server logs for specific patterns in the request URI. It looks for directory traversal sequences ('../'), attempts to access common sensitive files like '/etc/passwd', or patterns indicating file inclusion via HTTP or file:// protocols.
This analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. It leverages Cisco Secure Firewall Threat Defense logs and identifies connections where the action is set to Block, and the number of occurrences reaches or exceeds a threshold of ten within a one-minute span. This pattern may indicate a misconfigured application, unauthorized access attempts, or early stages of a brute-force or scanning operation. If confirmed malicious, this behavior may represent an attacker probing the network, attempting lateral movement, or testing firewall rules for weaknesses.
The following analytic detects a blocked connection event by identifying a "Block" value in the action field. It leverages logs from Cisco Secure Firewall Threat Defense devices. This activity is significant as it can identify attempts from users or applications initiating network connection to explicitly or implicitly blocked range or zones. If confirmed malicious, attackers could be attempting to perform a forbidden action on the network such as data exfiltration, lateral movement, or network disruption.
KQL Query
Page 9 of 11