Network Detections

Name Data Source Technique Type Analytic Story Date
3CX Supply Chain Attack Network Indicators Sysmon EventID 22 Compromise Software Supply Chain TTP 3CX Supply Chain Attack 2025-05-02
Cisco Secure Firewall - Binary File Type Download Cisco Secure Firewall Threat Defense File Event Exploitation for Client Execution Command and Scripting Interpreter Anomaly Cisco Secure Firewall Threat Defense Analytics 2025-05-02
Cisco Secure Firewall - Bits Network Activity Cisco Secure Firewall Threat Defense Connection Event N/A Anomaly Cisco Secure Firewall Threat Defense Analytics 2025-05-02
Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint Cisco Secure Firewall Threat Defense Connection Event Code Signing Certificates Digital Certificates Web Protocols Asymmetric Cryptography TTP Cisco Secure Firewall Threat Defense Analytics 2025-05-02
Cisco Secure Firewall - Blocked Connection Cisco Secure Firewall Threat Defense Connection Event Remote System Discovery Network Service Discovery Brute Force Exploitation for Client Execution Vulnerability Scanning Anomaly Cisco Secure Firewall Threat Defense Analytics 2025-05-02
Cisco Secure Firewall - Communication Over Suspicious Ports Cisco Secure Firewall Threat Defense Connection Event Remote Services Process Injection PowerShell Ingress Tool Transfer Remote Access Tools Non-Standard Port Anomaly Cisco Secure Firewall Threat Defense Analytics 2025-05-02
Cisco Secure Firewall - Connection to File Sharing Domain Cisco Secure Firewall Threat Defense Connection Event Web Protocols External Proxy Ingress Tool Transfer Exfiltration to Cloud Storage Tool Anomaly Cisco Secure Firewall Threat Defense Analytics 2025-05-02
Cisco Secure Firewall - File Download Over Uncommon Port Cisco Secure Firewall Threat Defense File Event Ingress Tool Transfer Non-Standard Port Anomaly Cisco Secure Firewall Threat Defense Analytics 2025-05-02
Cisco Secure Firewall - High EVE Threat Confidence Cisco Secure Firewall Threat Defense Connection Event Exfiltration Over C2 Channel Web Protocols Ingress Tool Transfer Asymmetric Cryptography Anomaly Cisco Secure Firewall Threat Defense Analytics 2025-05-02
Cisco Secure Firewall - High Volume of Intrusion Events Per Host Cisco Secure Firewall Threat Defense Intrusion Event Command and Scripting Interpreter Application Layer Protocol Vulnerability Scanning Anomaly Cisco Secure Firewall Threat Defense Analytics 2025-05-02
Cisco Secure Firewall - Malware File Downloaded Cisco Secure Firewall Threat Defense File Event Exploitation for Client Execution Ingress Tool Transfer Anomaly Cisco Secure Firewall Threat Defense Analytics 2025-05-02
Cisco Secure Firewall - Possibly Compromised Host Cisco Secure Firewall Threat Defense Intrusion Event Exploitation for Client Execution Command and Scripting Interpreter Malware Anomaly Cisco Secure Firewall Threat Defense Analytics 2025-05-02
Cisco Secure Firewall - Potential Data Exfiltration Cisco Secure Firewall Threat Defense Connection Event Exfiltration Over C2 Channel Exfiltration to Cloud Storage Exfiltration Over Unencrypted Non-C2 Protocol Anomaly Cisco Secure Firewall Threat Defense Analytics 2025-05-02
Cisco Secure Firewall - Rare Snort Rule Triggered Cisco Secure Firewall Threat Defense Intrusion Event Phishing for Information Web Services Hunting Cisco Secure Firewall Threat Defense Analytics 2025-05-02
Cisco Secure Firewall - Repeated Blocked Connections Cisco Secure Firewall Threat Defense Connection Event Remote System Discovery Network Service Discovery Brute Force Exploitation for Client Execution Vulnerability Scanning Anomaly Cisco Secure Firewall Threat Defense Analytics 2025-05-02
Cisco Secure Firewall - Repeated Malware Downloads Cisco Secure Firewall Threat Defense File Event Ingress Tool Transfer Obfuscated Files or Information Anomaly Cisco Secure Firewall Threat Defense Analytics 2025-05-02
Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts Cisco Secure Firewall Threat Defense Intrusion Event Ingress Tool Transfer Obfuscated Files or Information Anomaly Cisco Secure Firewall Threat Defense Analytics 2025-05-02
Cisco Secure Firewall - Wget or Curl Download Cisco Secure Firewall Threat Defense Connection Event Cron Command and Scripting Interpreter Web Protocols Ingress Tool Transfer Anomaly Cisco Secure Firewall Threat Defense Analytics 2025-05-02
Detect ARP Poisoning Hardware Additions Network Denial of Service ARP Cache Poisoning TTP Router and Infrastructure Security 2025-05-02
Detect DGA domains using pretrained model in DSDL Domain Generation Algorithms Anomaly Command And Control, DNS Hijacking, Data Exfiltration, Dynamic DNS, Suspicious DNS Traffic 2025-05-02
Detect DNS Data Exfiltration using pretrained model in DSDL Exfiltration Over Unencrypted Non-C2 Protocol Anomaly Command And Control, DNS Hijacking, Suspicious DNS Traffic 2025-05-02
Detect DNS Query to Decommissioned S3 Bucket Sysmon EventID 22 Data Destruction Anomaly AWS S3 Bucket Security Monitoring, Data Destruction 2025-05-02
Detect hosts connecting to dynamic domain providers Sysmon EventID 22 Drive-by Compromise TTP Command And Control, DNS Hijacking, Data Protection, Dynamic DNS, Prohibited Traffic Allowed or Protocol Mismatch, Suspicious DNS Traffic 2025-05-02
Detect IPv6 Network Infrastructure Threats Hardware Additions Network Denial of Service ARP Cache Poisoning TTP Router and Infrastructure Security 2025-05-02
Detect Large ICMP Traffic Palo Alto Network Traffic Non-Application Layer Protocol TTP Backdoor Pingpong, China-Nexus Threat Activity, Command And Control 2025-05-02
Detect Outbound LDAP Traffic Palo Alto Network Traffic Exploit Public-Facing Application Command and Scripting Interpreter Hunting Log4Shell CVE-2021-44228 2025-05-02
Detect Outbound SMB Traffic Zeek Conn File Transfer Protocols TTP DHS Report TA18-074A, Hidden Cobra Malware, NOBELIUM Group 2025-05-02
Detect Port Security Violation Hardware Additions Network Denial of Service ARP Cache Poisoning TTP Router and Infrastructure Security 2025-05-02
Detect Remote Access Software Usage DNS Sysmon EventID 22 Remote Access Tools Anomaly CISA AA24-241A, Command And Control, Insider Threat, Ransomware, Remote Monitoring and Management Software 2025-05-02
Detect Remote Access Software Usage Traffic Palo Alto Network Traffic Remote Access Tools Anomaly Command And Control, Insider Threat, Ransomware, Remote Monitoring and Management Software 2025-05-02
Detect Rogue DHCP Server Hardware Additions Network Denial of Service Adversary-in-the-Middle TTP Router and Infrastructure Security 2025-05-02
Detect SNICat SNI Exfiltration Exfiltration Over C2 Channel TTP Data Exfiltration 2025-05-02
Detect Software Download To Network Device TFTP Boot TTP Router and Infrastructure Security 2025-05-02
Detect suspicious DNS TXT records using pretrained model in DSDL Domain Generation Algorithms Anomaly Command And Control, DNS Hijacking, Suspicious DNS Traffic 2025-05-02
Detect Traffic Mirroring Traffic Duplication Hardware Additions Network Denial of Service TTP Router and Infrastructure Security 2025-05-02
Detect Unauthorized Assets by MAC address N/A TTP Asset Tracking 2025-05-02
Detect Windows DNS SIGRed via Splunk Stream Exploitation for Client Execution TTP Windows DNS SIGRed CVE-2020-1350 2025-05-02
Detect Windows DNS SIGRed via Zeek Exploitation for Client Execution TTP Windows DNS SIGRed CVE-2020-1350 2025-05-02
Detect Zerologon via Zeek Exploit Public-Facing Application TTP Black Basta Ransomware, Detect Zerologon Attack, Rhysida Ransomware 2025-05-02
DNS Query Length Outliers - MLTK DNS Anomaly Command And Control, Hidden Cobra Malware, Suspicious DNS Traffic 2025-05-02
DNS Query Length With High Standard Deviation Sysmon EventID 22 Exfiltration Over Unencrypted Non-C2 Protocol Anomaly Command And Control, Hidden Cobra Malware, Suspicious DNS Traffic 2025-05-02
Excessive DNS Failures DNS Anomaly Command And Control, Suspicious DNS Traffic 2025-05-02
F5 BIG-IP iControl REST Vulnerability CVE-2022-1388 Palo Alto Network Threat Exploit Public-Facing Application External Remote Services TTP CISA AA24-241A, F5 BIG-IP Vulnerability CVE-2022-1388 2025-05-02
Hosts receiving high volume of network traffic from email server Remote Email Collection Anomaly Collection and Staging 2025-05-02
Internal Horizontal Port Scan AWS CloudWatchLogs VPCflow Network Service Discovery TTP Network Discovery 2025-05-02
Internal Horizontal Port Scan NMAP Top 20 AWS CloudWatchLogs VPCflow Network Service Discovery TTP Network Discovery 2025-05-02
Internal Vertical Port Scan AWS CloudWatchLogs VPCflow Network Service Discovery TTP Network Discovery 2025-05-02
Internal Vulnerability Scan Vulnerability Scanning Network Service Discovery TTP Network Discovery 2025-05-02
Large Volume of DNS ANY Queries Reflection Amplification Anomaly DNS Amplification Attacks 2025-05-02
Ngrok Reverse Proxy on Network Sysmon EventID 22 Protocol Tunneling Proxy Web Service Anomaly CISA AA22-320A, CISA AA24-241A, Reverse Network Proxy 2025-05-02
Prohibited Network Traffic Allowed Zeek Conn Exfiltration Over Alternative Protocol TTP Command And Control, Prohibited Traffic Allowed or Protocol Mismatch, Ransomware 2025-05-02
Protocol or Port Mismatch Exfiltration Over Unencrypted Non-C2 Protocol Anomaly Command And Control, Prohibited Traffic Allowed or Protocol Mismatch 2025-05-02
Protocols passing authentication in cleartext N/A Anomaly Use of Cleartext Protocols 2025-05-02
Remote Desktop Network Traffic Zeek Conn Remote Desktop Protocol Anomaly Active Directory Lateral Movement, Hidden Cobra Malware, Ryuk Ransomware, SamSam Ransomware 2025-05-02
Rundll32 DNSQuery Sysmon EventID 22 Rundll32 TTP IcedID, Living Off The Land 2025-05-02
SMB Traffic Spike SMB/Windows Admin Shares Anomaly DHS Report TA18-074A, Emotet Malware DHS Report TA18-201A, Hidden Cobra Malware, Ransomware 2025-05-02
SMB Traffic Spike - MLTK SMB/Windows Admin Shares Anomaly DHS Report TA18-074A, Emotet Malware DHS Report TA18-201A, Hidden Cobra Malware, Ransomware 2025-05-02
SSL Certificates with Punycode Encrypted Channel Hunting OpenSSL CVE-2022-3602 2025-05-02
Suspicious Process DNS Query Known Abuse Web Services Sysmon EventID 22 Visual Basic TTP Cactus Ransomware, Data Destruction, Meduza Stealer, PXA Stealer, Phemedrone Stealer, Remcos, Snake Keylogger, WhisperGate 2025-05-02
Suspicious Process With Discord DNS Query Sysmon EventID 22 Visual Basic Anomaly Cactus Ransomware, Data Destruction, PXA Stealer, WhisperGate 2025-05-02
TOR Traffic Palo Alto Network Traffic Multi-hop Proxy TTP Command And Control, NOBELIUM Group, Prohibited Traffic Allowed or Protocol Mismatch, Ransomware 2025-05-02
Wermgr Process Connecting To IP Check Web Services Sysmon EventID 22 IP Addresses TTP Trickbot 2025-05-02
Windows Abused Web Services Sysmon EventID 22 Web Service TTP CISA AA24-241A, NjRAT 2025-05-02
Windows AD Replication Service Traffic DCSync Rogue Domain Controller TTP Sneaky Active Directory Persistence Tricks 2025-05-02
Windows AD Rogue Domain Controller Network Activity Rogue Domain Controller TTP Sneaky Active Directory Persistence Tricks 2025-05-02
Windows DNS Query Request by Telegram Bot API Sysmon EventID 22 DNS Bidirectional Communication Anomaly Crypto Stealer 2025-05-02
Windows Gather Victim Network Info Through Ip Check Web Services Sysmon EventID 22 IP Addresses Hunting Azorult, DarkCrystal RAT, Handala Wiper, Meduza Stealer, PXA Stealer, Phemedrone Stealer, Snake Keylogger, Water Gamayun 2025-05-02
Windows Multi hop Proxy TOR Website Query Sysmon EventID 22 Mail Protocols Anomaly AgentTesla 2025-05-02
Windows Remote Desktop Network Bruteforce Attempt Sysmon EventID 3 Password Guessing Anomaly Compromised User Account, Ryuk Ransomware, SamSam Ransomware 2025-05-02
Windows Spearphishing Attachment Connect To None MS Office Domain Sysmon EventID 22 Spearphishing Attachment Hunting AsyncRAT, Spearphishing Attachments 2025-05-02
Zeek x509 Certificate with Punycode Encrypted Channel Hunting OpenSSL CVE-2022-3602 2025-05-02
OSZAR »