Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9 detections
Filters
Last updated
All Time
Detection languages
5
3
1
Contributors
3
2
2
2
Categories
4
3
2
2
2
Platforms
4
2
2
1
1
Products / Services
3
2
2
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
3
IDS Protocols
3
Detects anomalous DNS query patterns where a single host resolves multiple unique subdomains associated with Dahua or QuickDDNS services. This behavior is indicative of passive reconnaissance, often used to map public-facing IoT devices such as cameras and DVRs.
Detects a potential exploitation of the SearchLeak (CVE-2026-42824) vulnerability in Microsoft 365 Copilot, where raw HTML <img> tags containing Bing Search-by-Image parameters are rendered during the streaming phase before proper sanitization occurs. This could potentially allow for SSRF or information leakage through malicious image references.
FOFA Internet Asset Search Query
Suricata
This rule detects HTTP requests where the host header contains 'fofa.info'. FOFA is an internet asset search engine, similar to Shodan. This detection indicates that a system within the HOME_NET is making queries to FOFA, which could be part of reconnaissance activities to gather information about internet-facing assets.
This rule detects HTTP requests made to 'search.censys.io', indicating a query to the Censys Internet Asset Database. This activity is often associated with reconnaissance efforts, where an attacker or security researcher gathers information about internet-facing assets.
This rule detects HTTP requests to 'api.shodan.io', indicating a potential query to the Shodan Internet Scan Database. This activity could be part of reconnaissance efforts by an attacker or security researcher to gather information about internet-connected devices and services.
KQL Query from file: Threat Hunting - MDE Network Intrusion Discovery
KQL Query
'Discover all critical ports from a list having rules like 'Any' for sourceIp, which means that they are opened to everyone. Critial ports should not be opened to everyone, and should be filtered.'
'This hunting query looks for queries that appear to be looking for secrets or passwords in tables.'