Search and filter across all detection sources
619 rules
[SONICWALL] Wan Failover - Possible recon
[SONICWALL] Wan Failover - Recon attempt
[SONICWALL] Wan Failover - Possible recon attempt
Windows installer reconfigured the product
[CITRIX-CORRELATED] Login after recon activity
[COURIER-CORRELATED] Timeout after recon activity
[IMAPD-CORRELATED] Connection after recon activity
[IMAPD-CORRELATED] Disconnect after recon activity
[IMAPD-CORRELATED] Login after recon activity
[IMAPD-CORRELATED] Logout after recon activity
[IMAPD-CORRELATED] Timeout after recon activity
[VSFTPD-CORRELATED] Authentication after recon activity
ReconCommands_in_File [yara]
Detects various recon commands in a single file
Recon_Commands_Windows_Gen1 [yara]
Detects a set of reconnaissance commands on Windows systems
[CISCO-CORRELATED] Console login after recon activity
[CISCO-CORRELATED] Login permitted after recon activity
[CISCO-CORRELATED] VPN login after recon activity
[COURIER-CORRELATED] Logout/disconnect after recon activity
[COURIER-CORRELATED] User login after recon activity
[FATPIPE-CORRELATED] Login Success after recon activity
[FORTINET-CORRELATED] Administrator Login after recon activity
[FORTINET-CORRELATED] Login accepted after recon activity
[OPENSSH-CORRELATED] Authentication success after recon activity
[VSFTPD-CORRELATED] File uploaded after recon activity
[WINDOWS-OWA-CORRELATED] Login after recon activity