GitHub Repo

Network Detections

Name Data Source Technique Type Analytic Story Date
Serialized PHP Token in Upload Filename - Suricata Suricata T1190 Anomaly PHP2Shell 2026-10-28
Confluence CVE-2023-22515 Trigger Vulnerability Suricata T1190 TTP CVE-2023-22515 Privilege Escalation Vulnerability Confluence Data Center and Server 2026-05-13
Juniper Networks Remote Code Execution Exploit Detection Suricata T1059 T1105 T1190 TTP Juniper JunOS Remote Code Execution 2026-05-13
Citrix ADC and Gateway CitrixBleed 2 Memory Disclosure Suricata T1190 Anomaly Citrix NetScaler ADC and NetScaler Gateway CVE-2025-5777 2026-05-13
PHP Opening Tag in Upload Filename - Suricata Suricata T1190 Anomaly PHP2Shell 2026-10-28
JetBrains TeamCity Authentication Bypass CVE-2024-27198 Suricata T1190 TTP JetBrains TeamCity Vulnerabilities 2026-05-13
Access to Vulnerable Ivanti Connect Secure Bookmark Endpoint Suricata T1190 TTP CISA AA24-241A, Ivanti Connect Secure VPN Vulnerabilities 2026-05-13
Ivanti Connect Secure System Information Access via Auth Bypass Suricata T1190 Anomaly CISA AA24-241A, Ivanti Connect Secure VPN Vulnerabilities 2026-05-13
F5 TMUI Authentication Bypass Suricata N/A TTP F5 Authentication Bypass with TMUI 2026-05-13
ConnectWise ScreenConnect Authentication Bypass Suricata T1190 TTP ConnectWise ScreenConnect Vulnerabilities, Seashell Blizzard 2026-05-13
Citrix ADC and Gateway Unauthorized Data Disclosure Suricata T1190 TTP Scattered Lapsus$ Hunters, Citrix NetScaler ADC and NetScaler Gateway CVE-2023-4966 2026-05-13
Confluence Pre-Auth RCE via OGNL Injection CVE-2023-22527 Suricata T1190 TTP Confluence Data Center and Confluence Server Vulnerabilities 2026-05-13
Ivanti Connect Secure Command Injection Attempts Suricata T1190 TTP CISA AA24-241A, Ivanti Connect Secure VPN Vulnerabilities 2026-05-13
JetBrains TeamCity Limited Auth Bypass Suricata CVE-2024-27199 Suricata T1190 TTP JetBrains TeamCity Vulnerabilities 2026-05-13
JetBrains TeamCity Authentication Bypass Suricata CVE-2024-27198 Suricata T1190 TTP JetBrains TeamCity Vulnerabilities, Hellcat Ransomware 2026-05-13
Cisco NVM - Suspicious File Download via Headless Browser Cisco Network Visibility Module Flow Data T1059 T1105 TTP BlankGrabber Stealer, Cisco Network Visibility Module Analytics 2026-09-22
Cisco NVM - Rclone Execution With Network Activity Cisco Network Visibility Module Flow Data T1567.002 Anomaly Scattered Lapsus$ Hunters, Cisco Network Visibility Module Analytics 2026-09-22
Cisco NVM - Installation of Typosquatted Python Package Cisco Network Visibility Module Flow Data T1059 TTP Cisco Network Visibility Module Analytics 2026-09-22
Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download Cisco Network Visibility Module Flow Data T1218.005 Anomaly Cisco Network Visibility Module Analytics 2026-09-22
Cisco NVM - Browser Spawned Unix Shell with External Connection Cisco Network Visibility Module Flow Data T1059 Anomaly Cisco Network Visibility Module Analytics 2026-09-22
Cisco NVM - Outbound Connection to Suspicious Port Cisco Network Visibility Module Flow Data T1571 Anomaly Cisco Network Visibility Module Analytics 2026-09-22
Cisco NVM - Suspicious Network Connection From Process With No Args Cisco Network Visibility Module Flow Data T1055 T1218 Anomaly Cisco Network Visibility Module Analytics 2026-09-22
Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI Cisco Network Visibility Module Flow Data T1059.005 T1218.005 Anomaly BlankGrabber Stealer, Cisco Network Visibility Module Analytics 2026-09-22
Cisco NVM - Non-Network Binary Making Network Connection Cisco Network Visibility Module Flow Data T1036 T1055 Anomaly Cisco Network Visibility Module Analytics 2026-09-22
Cisco NVM - Susp Script From Archive Triggering Network Activity Cisco Network Visibility Module Flow Data T1059.005 T1204.002 Anomaly Cisco Network Visibility Module Analytics 2026-09-22
Cisco NVM - Suspicious Network Connection Initiated via MsXsl Cisco Network Visibility Module Flow Data T1220 Anomaly Cisco Network Visibility Module Analytics 2026-09-22
Cisco NVM - Suspicious Network Connection to IP Lookup Service API Cisco Network Visibility Module Flow Data T1016 T1590.005 Anomaly BlankGrabber Stealer, Cisco Network Visibility Module Analytics, Castle RAT 2026-09-22
Cisco NVM - Osascript Network Connection for a Long Duration Cisco Network Visibility Module Flow Data T1059.002 T1071.001 Anomaly MacOS Post-Exploitation, Cisco Network Visibility Module Analytics, Command And Control 2026-09-22
Cisco NVM - Curl Execution With Insecure Flags Cisco Network Visibility Module Flow Data T1197 Anomaly PromptLock, Microsoft WSUS CVE-2025-59287, Cisco Network Visibility Module Analytics 2026-09-22
Cisco Secure Firewall - Citrix NetScaler Memory Overread Attempt Cisco Secure Firewall Threat Defense Intrusion Event T1059 T1203 TTP Citrix NetScaler ADC and NetScaler Gateway CVE-2025-5777, Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco Secure Firewall - Oracle E-Business Suite Correlation Cisco Secure Firewall Threat Defense Intrusion Event T1190 TTP Cisco Secure Firewall Threat Defense Analytics, Oracle E-Business Suite Exploitation 2026-05-13
Cisco Secure Firewall - Blocked Connection Cisco Secure Firewall Threat Defense Connection Event T1018 T1046 T1110 T1203 T1595.002 Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco Secure Firewall - Static Tundra Smart Install Abuse Cisco Secure Firewall Threat Defense Intrusion Event T1190 T1210 T1499 TTP Cisco Smart Install Remote Code Execution CVE-2018-0171, Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Zeek x509 Certificate with Punycode T1573 Hunting OpenSSL CVE-2022-3602 2026-05-13
Cisco Secure Firewall - PHP2Shell Suspicious Upload Activity Cisco Secure Firewall Threat Defense Intrusion Event T1190 TTP PHP2Shell, Cisco Secure Firewall Threat Defense Analytics 2026-10-28
Cisco Secure Firewall - React Server Components RCE Attempt Cisco Secure Firewall Threat Defense Intrusion Event T1190 TTP React2Shell 2026-05-13
Cisco Secure Firewall - Possibly Compromised Host Cisco Secure Firewall Threat Defense Intrusion Event T1059 T1203 T1587.001 Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco Secure Firewall - Lumma Stealer Activity Cisco Secure Firewall Threat Defense Intrusion Event T1027 T1190 T1204 T1210 TTP Lumma Stealer, Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint Cisco Secure Firewall Threat Defense Connection Event T1071.001 T1573.002 T1587.002 T1588.004 TTP Cisco Secure Firewall Threat Defense Analytics 2026-09-22
Detect IPv6 Network Infrastructure Threats Cisco IOS Logs T1200 T1498 T1557.002 TTP Scattered Lapsus$ Hunters, Router and Infrastructure Security 2026-05-13
Cisco SA - Access to Anonymizer Services Cisco Secure Access DNS T1090.003 Anomaly Cisco Secure Access Analytics 2026-06-09
Cisco Secure Firewall - Repeated Malware Downloads Cisco Secure Firewall Threat Defense File Event T1027 T1105 Anomaly Hellcat Ransomware, Cisco Secure Firewall Threat Defense Analytics 2026-09-22
Cisco Secure Firewall - Rare Snort Rule Triggered Cisco Secure Firewall Threat Defense Intrusion Event T1583.006 T1598 Hunting Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco Secure Firewall - High EVE Threat Confidence Cisco Secure Firewall Threat Defense Connection Event T1041 T1071.001 T1105 T1573.002 Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco Secure Firewall - Potential Data Exfiltration Cisco Secure Firewall Threat Defense Connection Event T1041 T1048.003 T1567.002 Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts Cisco Secure Firewall Threat Defense Intrusion Event T1027 T1105 Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Detect Zerologon via Zeek T1190 TTP Rhysida Ransomware, Detect Zerologon Attack, Black Basta Ransomware 2026-05-13
Cisco Secure Firewall - Malware File Downloaded Cisco Secure Firewall Threat Defense File Event T1105 T1203 Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-09-22
Cisco Secure Firewall - Wget or Curl Download Cisco Secure Firewall Threat Defense Connection Event T1053.003 T1059 T1071.001 T1105 Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco SD-WAN - Arbitrary File Overwrite Exploitation Activity Cisco SD-WAN Service Proxy Access Logs T1190 TTP Cisco Catalyst SD-WAN Analytics 2026-05-13
Cisco Secure Firewall - Lumma Stealer Outbound Connection Attempt Cisco Secure Firewall Threat Defense Intrusion Event T1041 T1573.002 Anomaly Lumma Stealer, Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco Secure Firewall - SSH Connection to sshd_operns Cisco Secure Firewall Threat Defense Intrusion Event T1021.004 Anomaly Cisco Secure Firewall Threat Defense Analytics, Salt Typhoon 2026-05-13
Cisco Secure Firewall - SSH Connection to Non-Standard Port Cisco Secure Firewall Threat Defense Intrusion Event T1021.004 Anomaly Cisco Secure Firewall Threat Defense Analytics, Salt Typhoon 2026-05-13
Cisco Secure Firewall - PHP2Shell Serialized Payload Activity Cisco Secure Firewall Threat Defense Intrusion Event T1190 TTP PHP2Shell, Cisco Secure Firewall Threat Defense Analytics 2026-10-28
Cisco Secure Firewall - Bits Network Activity Cisco Secure Firewall Threat Defense Connection Event N/A Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco Secure Firewall - Binary File Type Download Cisco Secure Firewall Threat Defense File Event T1059 T1203 Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-09-22
Cisco Secure Firewall - Repeated Blocked Connections Cisco Secure Firewall Threat Defense Connection Event T1018 T1046 T1110 T1203 T1595.002 Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco SD-WAN - Uncommon User-Agent Multi-URI Activity Cisco SD-WAN Service Proxy Access Logs T1595 Hunting Cisco Catalyst SD-WAN Analytics 2026-05-13
Cisco Secure Firewall - Intrusion Events by Threat Activity Cisco Secure Firewall Threat Defense Intrusion Event T1041 T1573.002 Anomaly ArcaneDoor, Cisco Secure Firewall Threat Defense Analytics 2026-09-22
Unusual SSH Client Banner Zeek SSH T1021.004 T1572 Anomaly Ingress Tool Transfer, Command And Control 2026-10-12
Cisco Secure Firewall - Lumma Stealer Download Attempt Cisco Secure Firewall Threat Defense Intrusion Event T1041 T1573.002 Anomaly Lumma Stealer, Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco Secure Firewall - Oracle E-Business Suite Exploitation Cisco Secure Firewall Threat Defense Intrusion Event T1190 TTP Cisco Secure Firewall Threat Defense Analytics, Oracle E-Business Suite Exploitation 2026-05-13
Cisco Secure Firewall - PHP2Shell Exploitation Attempt Cisco Secure Firewall Threat Defense Intrusion Event T1190 TTP PHP2Shell, Cisco Secure Firewall Threat Defense Analytics 2026-10-28
Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity Cisco Secure Firewall Threat Defense Intrusion Event T1003.001 T1059.001 T1190 T1210 TTP Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco Secure Firewall - Communication Over Suspicious Ports Cisco Secure Firewall Threat Defense Connection Event T1021 T1055 T1059.001 T1105 T1219 T1571 Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-10-08
Cisco Secure Firewall - High Volume of Intrusion Events Per Host Cisco Secure Firewall Threat Defense Intrusion Event T1059 T1071 T1595.002 Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco Secure Firewall - Connection to File Sharing Domain Cisco Secure Firewall Threat Defense Connection Event T1071.001 T1090.002 T1105 T1567.002 T1588.002 Anomaly Scattered Lapsus$ Hunters, Cisco Secure Firewall Threat Defense Analytics 2026-10-08
Cisco Secure Firewall - File Download Over Uncommon Port Cisco Secure Firewall Threat Defense File Event T1105 T1571 Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-09-22
Cisco Secure Firewall - High Priority Intrusion Classification Cisco Secure Firewall Threat Defense Intrusion Event T1003 T1071 T1078 T1190 T1203 TTP Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Ollama Abnormal Network Connectivity Ollama Server N/A Anomaly Suspicious Ollama Activities 2026-10-19
ESXi Firewall Disabled VMWare ESXi Syslog T1686 TTP ESXi Post Compromise, China-Nexus Threat Activity, Black Basta Ransomware 2026-05-13
Cisco Duo Policy Allow Network Bypass 2FA Cisco Duo Administrator T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
VMware Server Side Template Injection Hunt Palo Alto Network Threat T1133 T1190 Hunting VMware Server Side Injection and Privilege Escalation 2026-05-13
Confluence Unauthenticated Remote Code Execution CVE-2022-26134 Palo Alto Network Threat T1133 T1190 T1505 TTP Confluence Data Center and Confluence Server Vulnerabilities, Atlassian Confluence Server and Data Center CVE-2022-26134 2026-05-13
Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35082 Suricata T1133 T1190 TTP Ivanti EPMM Remote Unauthenticated Access 2026-05-13
ProxyShell ProxyNotShell Behavior Detected T1133 T1190 Correlation ProxyShell, Seashell Blizzard, ProxyNotShell 2026-05-13
VMWare Aria Operations Exploit Attempt Palo Alto Network Threat T1068 T1133 T1190 T1210 TTP VMware Aria Operations vRealize CVE-2023-20887 2026-05-13
Fortinet Appliance Auth bypass Palo Alto Network Threat T1133 T1190 TTP CVE-2022-40684 Fortinet Appliance Auth bypass 2026-05-13
WS FTP Remote Code Execution Suricata T1190 TTP WS FTP Server Critical Vulnerabilities 2026-05-13
Adobe ColdFusion Access Control Bypass Suricata T1190 Anomaly Adobe ColdFusion Arbitrary Code Execution CVE-2023-29298 CVE-2023-26360 2026-05-13
Microsoft SharePoint Server Elevation of Privilege Suricata T1068 Anomaly Microsoft SharePoint Server Elevation of Privilege CVE-2023-29357 2026-05-13
Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35078 Suricata T1133 T1190 TTP Ivanti EPMM Remote Unauthenticated Access 2026-05-13
JetBrains TeamCity RCE Attempt Suricata T1190 TTP JetBrains TeamCity Vulnerabilities, JetBrains TeamCity Unauthenticated RCE, CISA AA23-347A 2026-05-13
Citrix ADC Exploitation CVE-2023-3519 Palo Alto Network Threat T1190 Hunting CISA AA24-241A, Citrix Netscaler ADC CVE-2023-3519 2026-09-01
Exploit Public-Facing Fortinet FortiNAC CVE-2022-39952 Palo Alto Network Threat T1133 T1190 TTP Hellcat Ransomware, Fortinet FortiNAC CVE-2022-39952 2026-05-13
Adobe ColdFusion Unauthenticated Arbitrary File Read Suricata T1190 Anomaly Adobe ColdFusion Arbitrary Code Execution CVE-2023-29298 CVE-2023-26360 2026-05-13
Cisco IOS XE Implant Access Suricata T1190 TTP Cisco IOS XE Software Web Management User Interface vulnerability 2026-05-13
Detect Remote Access Software Usage URL Palo Alto Network Threat T1219 Anomaly Ransomware, CISA AA24-241A, Remote Monitoring and Management Software, Interlock Ransomware, Insider Threat, Command And Control, Scattered Lapsus$ Hunters 2026-10-08
VMware Workspace ONE Freemarker Server-side Template Injection Palo Alto Network Threat T1133 T1190 Anomaly VMware Server Side Injection and Privilege Escalation 2026-05-13
Citrix ShareFile Exploitation CVE-2023-24489 Suricata T1190 Hunting Citrix ShareFile RCE CVE-2023-24489 2026-05-13
SAP NetWeaver Visual Composer Exploitation Attempt Suricata T1190 Hunting SAP NetWeaver Exploitation 2026-05-13
Ivanti EPM SQL Injection Remote Code Execution Suricata T1190 TTP Ivanti EPM Vulnerabilities, Hellcat Ransomware, GhostRedirector IIS Module and Rungan Backdoor 2026-05-13
Prohibited Network Traffic Allowed Cisco Secure Firewall Threat Defense Connection Event T1048 Anomaly Cisco Secure Firewall Threat Defense Analytics, Command And Control, Prohibited Traffic Allowed or Protocol Mismatch, Ransomware 2026-09-22
Cisco Network Interface Modifications Cisco IOS Logs T1021 T1133 T1556 Anomaly Cisco Smart Install Remote Code Execution CVE-2018-0171 2026-05-13
TOR Traffic Palo Alto Network Traffic, Cisco Secure Firewall Threat Defense Connection Event T1090.003 TTP NOBELIUM Group, Ransomware, Cisco Secure Firewall Threat Defense Analytics, Interlock Ransomware, Prohibited Traffic Allowed or Protocol Mismatch, Command And Control 2026-05-13
F5 BIG-IP iControl REST Vulnerability CVE-2022-1388 Palo Alto Network Threat T1133 T1190 TTP CISA AA24-241A, F5 BIG-IP Vulnerability CVE-2022-1388 2026-05-13
Protocol or Port Mismatch Cisco Secure Firewall Threat Defense Connection Event T1048.003 Anomaly Cisco Secure Firewall Threat Defense Analytics, Prohibited Traffic Allowed or Protocol Mismatch, Command And Control 2026-05-13
Excessive DNS Failures T1071.004 Anomaly Suspicious DNS Traffic, Command And Control 2026-05-13
Hosts receiving high volume of network traffic from email server T1114.002 Anomaly Collection and Staging 2026-05-13
Cisco Secure Firewall - Remote Access Software Usage Traffic Cisco Secure Firewall Threat Defense Connection Event T1219 Anomaly Ransomware, Remote Monitoring and Management Software, Cisco Secure Firewall Threat Defense Analytics, Interlock Ransomware, Insider Threat, Scattered Spider, Command And Control, Scattered Lapsus$ Hunters 2026-10-08
Detect Software Download To Network Device T1542.005 TTP Router and Infrastructure Security 2026-05-13
Protocols passing authentication in cleartext Cisco Secure Firewall Threat Defense Connection Event N/A Anomaly Scattered Lapsus$ Hunters, Cisco Secure Firewall Threat Defense Analytics, Use of Cleartext Protocols 2026-05-13
Detect Remote Access Software Usage Traffic Palo Alto Network Traffic T1219 Anomaly Ransomware, Remote Monitoring and Management Software, Interlock Ransomware, Insider Threat, Scattered Spider, Command And Control, Scattered Lapsus$ Hunters 2026-10-08
Large Volume of DNS ANY Queries T1498.002 Anomaly DNS Amplification Attacks 2026-05-13
Detect Outbound SMB Traffic Cisco Secure Firewall Threat Defense Connection Event, Cisco Secure Access Firewall T1071.002 TTP NOBELIUM Group, Hidden Cobra Malware, Cisco Secure Firewall Threat Defense Analytics, Cisco Secure Access Analytics, DHS Report TA18-074A 2026-05-13
Detect Large ICMP Traffic Palo Alto Network Traffic, Cisco Secure Access Firewall T1095 TTP Cisco Secure Access Analytics, China-Nexus Threat Activity, Backdoor Pingpong, Command And Control 2026-10-02
Remote Desktop Network Traffic Zeek Conn T1021.001 Anomaly Hidden Cobra Malware, Windows RDP Artifacts and Defense Evasion, Active Directory Lateral Movement, SamSam Ransomware, Ryuk Ransomware 2026-05-13