Search and filter across all detection sources
2,158 rules
Samba network problems.
[SNORT] Detection of a Network Scan
hijack_network [capabilities]
Hijack network configuration
network_dyndns [capabilities]
Communications dyndns network
Teleport Network Scan Initiated
A user has invoked a network scan that could potentially indicate enumeration of the network.
[UBIQUITI] Admin Activity - Admin Accessed UniFi Network From Outside HOME_NETWORK
[SONICWALL] Multiple DHCP servers detected on network
network_irc [capabilities]
Communications over IRC network
network_tor [capabilities]
Communications over TOR network
network_toredo [capabilities]
Communications over Toredo network
Upwind Network Detection Passthrough
Re-raises Upwind network security detections in Panther. Covers port scans, DoS activity, DNS anomalies, DNS-over-HTTPS abuse, and other anomalous network behaviors.
[KISMET] Older Lucent/Orinico card scanning the network
[PRISMA] Prisma Access Network Flood Attack - Critical Severity
[PRISMA] Prisma Access Network Flood Attack - High Severity
[PRISMA] Prisma Access Network Flood Attack - Medium Severity
[PRISMA] Prisma Access Network Scanning Activity - Critical Severity
[PRISMA] Prisma Access Network Scanning Activity - High Severity
[PRISMA] Prisma Access Network Scanning Activity - Medium Severity
EquationDrug_NetworkSniffer3 [yara]
EquationDrug - Network Sniffer - tdip.sys
webshell_NetworkFileManagerPHP [yara]
Web Shell - file NetworkFileManagerPHP.php
EquationDrug_NetworkSniffer2 [malware]
EquationDrug_NetworkSniffer3 [malware]
network_p2p_win [capabilities]
Communications over P2P network
network_udp_sock [capabilities]
Communications over UDP network