| splunk |
Cisco Secure Firewall - Communication Over Suspicious Ports |
production |
2026-10-08 |
| splunk |
Cisco NVM - Outbound Connection to Suspicious Port |
production |
2026-09-22 |
| splunk |
Cisco Secure Firewall - File Download Over Uncommon Port |
production |
2026-09-22 |
| elastic |
Script Interpreter Connection to Non-Standard Port |
production |
2026-09-18 |
| elastic |
SMTP to the Internet on Port 26/TCP |
production |
2026-09-18 |
| elastic |
Unusual Linux Network Port Activity |
production |
2026-09-18 |
| elastic |
Suspicious Outbound Network Connection via Unsigned Binary |
production |
2026-09-18 |
| elastic |
Suricata and Elastic Defend Network Correlation |
production |
2026-09-18 |
| elastic |
Potential Data Exfiltration Activity to an Unusual Destination Port |
production |
2026-09-18 |
| elastic |
Deprecated - Uncommon Destination Port Connection by Web Server |
deprecated |
2026-07-02 |
| elastic |
Deprecated - Potential Non-Standard Port HTTP/HTTPS connection |
deprecated |
2026-02-04 |
| elastic |
Deprecated - Potential Non-Standard Port SSH connection |
deprecated |
2026-02-04 |
| sigma |
Potentially Suspicious Malware Callback Communication - Linux |
test |
2024-05-10 |
| sigma |
Communication To Uncommon Destination Ports |
test |
2024-03-12 |
| sigma |
Potentially Suspicious Malware Callback Communication |
test |
2024-03-12 |
| elastic |
Potential Linux Reverse Connection through Port Knocking |
deprecated |
2024-02-22 |
| sigma |
Suspicious DNS Z Flag Bit Set |
test |
2022-11-29 |
| sigma |
Testing Usage of Uncommonly Used Port |
test |
2022-01-23 |
| sentinel |
Fortinet - Beacon pattern detected |
Scheduled |
— |