Carolina Dietz-Vargas
@SoulisCheap0 followers23 downloads60 copies9 likes826 views
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Categories
1
1
Platforms
1
Products / Services
1
MITRE Techniques
1
1
1
1
IDS Classtypes
1
Detects high-volume vulnerability and spyware threat activity originating from external (UNTRUSTED) sources targeting public-facing IP addresses.
This detection identifies potential exploitation attempts, scanning activity, and malicious payload delivery by monitoring PAN-OS threat logs where severity is not informational and the subtype indicates vulnerability or spyware.
The rule triggers when:
A source IP generates ≥100 reset-both actions within 1 hour (indicative of blocked exploit or aggressive scanning), or
A source IP generates ≥10 non-reset actions within 1 hour (indicative of potentially successful or partially successful attempts)
Enrichment includes ASN, country, organization, and city to support attribution, threat hunting, and blocking decisions.
This detection identifies potential exploitation attempts, scanning activity, and malicious payload delivery by monitoring PAN-OS threat logs where severity is not informational and the subtype indicates vulnerability or spyware.
The rule triggers when:
A source IP generates ≥100 reset-both actions within 1 hour (indicative of blocked exploit or aggressive scanning), or
A source IP generates ≥10 non-reset actions within 1 hour (indicative of potentially successful or partially successful attempts)
Enrichment includes ASN, country, organization, and city to support attribution, threat hunting, and blocking decisions.
Detects non-allowlisted browser extensions with risky names/permissions or TLD indicators in CrowdStrike Falcon InstalledBrowserExtension events.