| sigma |
MacOS Network Service Scanning |
test |
2026-10-19 |
| elastic |
Potential SYN-Based Port Scan Detected |
production |
2026-09-18 |
| elastic |
Potential SIP Extension Enumeration |
production |
2026-09-18 |
| elastic |
Potential Network Scan Detected |
production |
2026-09-18 |
| elastic |
Potential Network Sweep Detected |
production |
2026-09-18 |
| elastic |
Spike in Network Traffic To a Country |
production |
2026-09-18 |
| elastic |
Suspicious Network Tool Launch Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
DNS Enumeration Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suricata and Elastic Defend Network Correlation |
production |
2026-09-18 |
| elastic |
Spike in Network Traffic |
production |
2026-09-18 |
| elastic |
Spike in Firewall Denies |
production |
2026-09-18 |
| elastic |
Spike in host-based traffic |
production |
2026-09-18 |
| elastic |
Potential Linux Hack Tool Launched |
production |
2026-09-18 |
| elastic |
Suspicious Network Tool Launched Inside A Container |
production |
2026-09-18 |
| elastic |
Potential Subnet Scanning Activity from Compromised Host |
production |
2026-09-18 |
| elastic |
Potential Port Scanning Activity from Compromised Host |
production |
2026-09-18 |
| elastic |
Potential Network Scan Executed From Host |
production |
2026-09-18 |
| elastic |
Nping Process Activity |
production |
2026-09-18 |
| elastic |
Hping Process Activity |
production |
2026-09-18 |
| elastic |
Potential PowerShell HackTool Script by Function Names |
production |
2026-09-18 |
| elastic |
Potentially Suspicious Process Started via tmux or screen |
production |
2026-09-18 |
| elastic |
Newly Seen Commonly Abused Network Scanner |
production |
2026-09-15 |
| splunk |
Internal Horizontal Port Scan NMAP Top 20 |
production |
2026-09-08 |
| splunk |
Cisco IOS XE Remote Access Probe Burst |
production |
2026-05-20 |
| splunk |
Kubernetes Access Scanning |
production |
2026-05-13 |
| splunk |
Kubernetes Scanning by Unauthenticated IP Address |
production |
2026-05-13 |
| splunk |
Advanced IP or Port Scanner Execution |
production |
2026-05-13 |
| splunk |
Windows PsTools Recon Usage |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Blocked Connection |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Repeated Blocked Connections |
production |
2026-05-13 |
| splunk |
Internal Horizontal Port Scan |
production |
2026-05-13 |
| splunk |
Internal Vertical Port Scan |
production |
2026-05-13 |
| splunk |
Internal Vulnerability Scan |
experimental |
2026-05-13 |
| suricata |
ET INFO Insecure Proxy Discovery via AWS Instance Metadata Retrieval M1 |
rev 1 |
2026-03-17 |
| snort |
ET INFO Insecure Proxy Discovery via AWS Instance Metadata Retrieval M1 |
rev 1 |
2026-03-17 |
| snort |
ET INFO Insecure Proxy Discovery via AWS Instance Metadata Retrieval M2 |
rev 1 |
2026-03-17 |
| suricata |
ET INFO Insecure Proxy Discovery via AWS Instance Metadata Retrieval M2 |
rev 1 |
2026-03-17 |
| sigma |
OpenCanary - NMAP NULL Scan |
experimental |
2026-01-06 |
| sigma |
OpenCanary - NMAP FIN Scan |
experimental |
2026-01-06 |
| sigma |
OpenCanary - NMAP XMAS Scan |
experimental |
2026-01-06 |
| sigma |
OpenCanary - NMAP OS Scan |
experimental |
2026-01-06 |
| sigma |
OpenCanary - Host Port Scan (SYN Scan) |
experimental |
2026-01-06 |
| sigma |
Grixba Malware Reconnaissance Activity |
experimental |
2025-11-26 |
| sigma |
Python Initiated Connection |
test |
2025-03-05 |
| sigma |
PUA - NimScan Execution |
test |
2025-02-05 |
| sigma |
Linux Network Service Scanning Tools Execution |
test |
2024-09-19 |
| sigma |
PUA - SoftPerfect Netscan Execution |
test |
2024-04-25 |
| sigma |
Pnscan Binary Data Transmission Activity |
test |
2024-04-16 |
| sigma |
PUA - Nmap/Zenmap Execution |
test |
2023-12-11 |
| sigma |
HackTool - WinPwn Execution |
test |
2023-12-04 |
| sigma |
HackTool - WinPwn Execution - ScriptBlock |
test |
2023-12-04 |
| sigma |
Linux Network Service Scanning - Auditd |
test |
2023-09-26 |
| sigma |
HackTool - winPEAS Execution |
test |
2023-03-23 |
| sigma |
PUA - Advanced IP Scanner Execution |
test |
2023-02-07 |
| sigma |
PUA - Advanced Port Scanner Execution |
test |
2023-02-07 |
| sigma |
Advanced IP Scanner - File Event |
test |
2022-11-29 |
| sentinel |
A host is potentially running a hacking tool (ASIM Web Session schema) |
Scheduled |
— |