Use Case: Network Security Monitoring

Potential DNS Tunneling via Long and Unique Subdomains

Aug 25, 2026 · Domain: Network Use Case: Threat Detection Use Case: Network Security Monitoring Rule Type: ESQL Tactic: Command and Control Tactic: Exfiltration Data Source: Network Packet Capture Data Source: Network Traffic Data Source: Zeek Resources: Investigation Guide ·

Share on:

Identifies a client generating many unique, unusually long DNS query names to the same registered domain within a five-minute window. Malware DNS tunnels and DNS command-and-control commonly encode data in lengthy subdomain portions under one apex domain.

Potential DNS Rebinding from Public to Private Address

Aug 25, 2026 · Domain: Network Use Case: Threat Detection Use Case: Network Security Monitoring Tactic: Initial Access Rule Type: ESQL Data Source: Network Packet Capture Data Source: Network Traffic Data Source: Zeek Resources: Investigation Guide ·

Share on:

Identifies a client resolving the same public registered domain to both a public IP address and a private, loopback, link-local, unique-local IPv6, or shared address. This includes both address classes being observed at the same timestamp, and a public answer followed within five minutes by a private answer where the minimum TTL across all answer records in the private-answer events is 60 seconds or less. Either pattern is consistent with DNS rebinding that pivots browser or application trust to internal resources.

Potential Self-Signed TLS Certificate Recently Issued on External Connection

Aug 25, 2026 · Domain: Network Use Case: Network Security Monitoring Use Case: Threat Detection Tactic: Command and Control Rule Type: ESQL Data Source: Network Packet Capture Data Source: Network Traffic Resources: Investigation Guide ·

Share on:

Identifies completed outbound TLS connections to external destinations where the server presents a recently issued, likely self-signed certificate whose issuer and subject distinguished names are equal. C2 frameworks frequently use freshly generated self-signed certificates instead of publicly trusted CAs. This behavioral logic complements hash-based C2 certificate rules, such as default Cobalt Strike team-server certificates, by catching rotated or custom infrastructure that does not reuse default tooling certificates. Distinguished-name equality identifies self-issued certificates but does not cryptographically prove that the certificate signed itself. The rule does not cover private-CA signed certificates, where issuer and subject differ, or C2 that uses publicly trusted certificates such as Let's Encrypt.

Repeated Stalled TLS Handshakes via ALPN acme-tls/1 Extension

Aug 5, 2026 · Domain: Network Use Case: Threat Detection Use Case: Network Security Monitoring Use Case: Vulnerability Data Source: Network Traffic Tactic: Impact Resources: Investigation Guide ·

Share on:

This rule detects two ALPN-based denial-of-service patterns against TLS servers. The first identifies repeated stalled handshakes advertising the acme-tls/1 ALPN extension with no session established, indicating potential goroutine or worker exhaustion in reverse proxies. The second matches connections where a malformed ALPN extension triggers TLS alerts such as decode_error or illegal_parameter, consistent with zero-length ALPN list exploitation. Both patterns are anomalous outside of scheduled ACME TLS-ALPN-01 certificate validation activity.

Potential NFS Destructive Operation Burst

Aug 3, 2026 · Domain: Network Use Case: Threat Detection Use Case: Network Security Monitoring Tactic: Impact Data Source: Network Packet Capture Resources: Investigation Guide ·

Share on:

Identifies a burst of successful NFS write activity combined with destructive REMOVE or RENAME operations from a single client to one export server within a one-minute window. Ransomware and destructive actors often encrypt, delete, or rename large numbers of files on mounted NFS shares; this aggregation surfaces that behavior using NFS opcode telemetry when file paths are not available on the wire.

First Time Seen NFS AUTH_SYS Root UID Access

Aug 1, 2026 · Domain: Network Use Case: Threat Detection Use Case: Network Security Monitoring Tactic: Collection Data Source: Network Packet Capture Resources: Investigation Guide ·

Share on:

Identifies the first source and destination IP pair observed in a five-day history window where an NFS client asserts AUTH_SYS (RPC UNIX) credentials with UID 0 (root). NFSv3 and NFSv4 clients can claim arbitrary UIDs through AUTH_SYS, and weak export controls may honor root-equivalent access from unexpected hosts. This is a common precursor to unauthorized mounts, sensitive file reads, and remote encryption of exported shares.

First Time Seen Memcached Writer

Jul 31, 2026 · Domain: Network Use Case: Network Security Monitoring Use Case: Threat Detection Tactic: Impact Data Source: Network Packet Capture Resources: Investigation Guide ·

Share on:

Identifies the first successful or no-reply Memcached store command from a client to a server. Memcached commonly has no authentication, so an unauthorized writer can overwrite session tokens, poison cached application content, or alter security-sensitive state. This behavior can enable session hijacking such as the exposure described by CVE-2026-29093.

First-Time Destructive MongoDB Command from a Client IP

Jul 31, 2026 · Domain: Network Use Case: Network Security Monitoring Use Case: Threat Detection Tactic: Impact Data Source: Network Packet Capture Resources: Investigation Guide ·

Share on:

Identifies the first client IP observed issuing MongoDB commands that can drop databases, collections, indexes, users, or roles within a five-day history window. Adversaries with access to an exposed or compromised MongoDB service may use these commands to destroy data, disrupt applications, or prepare a wipe-and-extort attack.

MySQL User-Defined Function Injection

Jul 31, 2026 · Domain: Network Use Case: Network Security Monitoring Use Case: Threat Detection Tactic: Persistence Data Source: Network Packet Capture Resources: Investigation Guide ·

Share on:

Identifies MySQL statements that create a user-defined function backed by a shared library. Adversaries with sufficient database privileges can place a malicious library in the MySQL plugin directory and register it with "CREATE FUNCTION ... SONAME", establishing a database-resident primitive for operating-system command execution.

PostgreSQL COPY PROGRAM Command Execution

Jul 31, 2026 · Domain: Network Use Case: Network Security Monitoring Use Case: Threat Detection Tactic: Execution Data Source: Network Packet Capture Resources: Investigation Guide ·

Share on:

Identifies PostgreSQL "COPY" statements that invoke an operating-system command through the "PROGRAM" option. A superuser or role with "pg_execute_server_program" can use this feature to execute arbitrary commands as the PostgreSQL service account, a technique used after credential compromise and by cryptomining campaigns.

Cassandra JavaScript UDF Creation

Jul 31, 2026 · Domain: Network Use Case: Network Security Monitoring Use Case: Threat Detection Use Case: Vulnerability Tactic: Execution Data Source: Network Packet Capture Resources: Investigation Guide ·

Share on:

Identifies Cassandra Query Language statements that create a JavaScript user-defined function. On vulnerable and dangerously configured Cassandra servers, adversaries can abuse scripted UDF creation to escape the JavaScript sandbox and execute operating-system commands, including through CVE-2021-44521.

Thrift RPC Method from an External Client

Jul 31, 2026 · Domain: Network Use Case: Network Security Monitoring Use Case: Threat Detection Tactic: Initial Access Data Source: Network Packet Capture Resources: Investigation Guide ·

Share on:

Identifies the first decoded Apache Thrift RPC relationship from a public client address to a server. Thrift commonly connects trusted internal microservices and data platforms, and an externally originated method invocation can indicate an exposed service, unauthorized access, or exploitation of a public-facing Thrift endpoint.

Potential SIP REGISTER Brute Force

Jul 31, 2026 · Domain: Network Use Case: Threat Detection Use Case: Network Security Monitoring Tactic: Credential Access Data Source: Network Packet Capture Resources: Investigation Guide ·

Share on:

Identifies repeated SIP REGISTER authentication rejection responses for one or more extensions from a client to a VoIP server within five minutes. The rule distinguishes repeated failures from the single 401 or 407 challenge expected in a normal digest-authentication flow. Attackers brute-force extension credentials to register rogue endpoints for toll fraud, call interception, or registration hijacking.

Potential SIP Extension Enumeration

Jul 31, 2026 · Domain: Network Use Case: Threat Detection Use Case: Network Security Monitoring Tactic: Discovery Tactic: Reconnaissance Data Source: Network Packet Capture Resources: Investigation Guide ·

Share on:

Identifies SIP OPTIONS requests targeting many distinct extension values from a single client within two minutes. Attackers and VoIP scanners use OPTIONS sweeps to discover valid users before REGISTER brute force, toll fraud, or registration hijacking attempts.

Successful AMQP Multi-Queue Purge Burst

Jul 31, 2026 · Domain: Network Use Case: Network Security Monitoring Use Case: Threat Detection Tactic: Impact Data Source: Network Packet Capture Resources: Investigation Guide ·

Share on:

Identifies multiple successful AMQP queue purge operations issued by the same client to the same broker within a short period. The AMQP queue.purge method removes all messages from a queue that are not awaiting acknowledgment. Purging several distinct queues can indicate deliberate message destruction or disruption after broker credentials are compromised.

Potential ICMP Tunneling Activity to the Internet

Jul 5, 2026 · Domain: Network Tactic: Command and Control Use Case: Threat Detection Use Case: Network Security Monitoring Data Source: Network Traffic Resources: Investigation Guide ·

Share on:

Identifies ICMP Echo traffic from an internal host to an external destination with a larger-than-typical transaction size. Covert channels and ICMP tunneling tools embed data in echo payloads that exceed normal OS ping behavior, which is usually limited to small fixed-size packets.

ICMP Timestamp or Information Request from the Internet

Jul 5, 2026 · Domain: Network Tactic: Discovery Tactic: Reconnaissance Use Case: Network Security Monitoring Use Case: Threat Detection Data Source: Network Traffic Resources: Investigation Guide ·

Share on:

Identifies inbound ICMP Timestamp (type 13) or Information (type 15) requests from external addresses to internal RFC1918 destinations. These message types are rarely used in modern networks and are commonly associated with host and path fingerprinting during reconnaissance.

ICMP Redirect Message from Internal Host

Jul 5, 2026 · Domain: Network Tactic: Credential Access Use Case: Threat Detection Use Case: Network Security Monitoring Data Source: Network Traffic Resources: Investigation Guide ·

Share on:

Identifies ICMP Redirect messages (type 5 for IPv4, type 137 for IPv6) sourced from an internal IPv4 or IPv6 address. Legitimate redirects are normally sent only by on-path routers. A workstation or server emitting redirects can indicate route manipulation for adversary-in-the-middle activity.

Deprecated TLS Version or Weak Cipher Negotiated Externally

Jul 5, 2026 · Domain: Network Use Case: Network Security Monitoring Use Case: Threat Detection Data Source: Network Traffic Tactic: Credential Access Tactic: Command and Control Resources: Investigation Guide ·

Share on:

Identifies successful outbound TLS sessions that negotiate deprecated protocol versions (SSLv3, TLS 1.0, or TLS 1.1) or weak cipher suites such as RC4, 3DES, NULL, EXPORT, or anonymous Diffie-Hellman. Adversaries-in-the-middle and legacy malware often force these negotiations to decrypt or intercept traffic. Modern clients and services should negotiate TLS 1.2 or 1.3 with strong ciphers on internet-bound connections.

Potential DHCP Starvation via High Client MAC Cardinality

Jul 5, 2026 · Domain: Network Use Case: Threat Detection Use Case: Network Security Monitoring Tactic: Impact Data Source: Network Traffic Resources: Investigation Guide ·

Share on:

Identifies a burst of DHCP DISCOVER messages with an unusually high number of distinct client hardware addresses observed on the same capture segment within a short window. Attackers flood DISCOVER requests with spoofed or random MAC addresses to exhaust the DHCP lease pool, often as a precursor to deploying a rogue DHCP server.

Splunk Enterprise PostgreSQL Backup-to-Restore Potential RCE Sequence

Jul 2, 2026 · Domain: Network Use Case: Threat Detection Use Case: Vulnerability Use Case: Network Security Monitoring Tactic: Initial Access Data Source: Network Packet Capture Data Source: Network Traffic Data Source: Zeek Data Source: Suricata Resources: Investigation Guide ·

Share on:

Detects a POST to the Splunk Enterprise PostgreSQL backup endpoint followed by a POST to the restore endpoint from the same client to the same host within a 15-minute window. This sequence is unusual and can align with the public CVE-2026-20253 pre-authentication RCE chain, where an attacker stages a database dump via the backup path and executes attacker-controlled SQL via the restore path.

Splunk Enterprise PostgreSQL Recovery Endpoint Injection Artifacts

Jul 2, 2026 · Domain: Network Use Case: Threat Detection Use Case: Vulnerability Use Case: Network Security Monitoring Tactic: Initial Access Data Source: Azure Data Source: Elastic Defend Data Source: GCP Data Source: Google Cloud Platform Data Source: Network Packet Capture Data Source: Network Traffic Data Source: Zeek Data Source: Suricata Resources: Investigation Guide ·

Share on:

Detects CVE-2026-20253 exploit artifacts against the Splunk Enterprise PostgreSQL sidecar recovery endpoints via complementary signals. Where endpoint or Network Packet Capture request-body logging is available, the rule matches PostgreSQL connection-string injection keywords, suspicious backupFile destinations, and known filesystem artifacts used to pivot from backup/restore primitives to file write or RCE. It also detects vulnerable recovery endpoint probing and empty-password Basic auth credentials observed in public exploit tooling.

Multiple DHCP Servers Responding to the Same Transaction

Jun 17, 2026 · Domain: Network Domain: Endpoint Use Case: Threat Detection Use Case: Vulnerability Use Case: Network Security Monitoring Tactic: Credential Access Tactic: Execution Data Source: Network Traffic Resources: Investigation Guide ·

Share on:

Identifies two or more distinct DHCP servers sending an OFFER or ACK for the same transaction ID (xid) within a short window, indicating a rogue DHCP server racing the legitimate one to win the client's handshake. This is the rogue-DHCP / adversary-in-the-middle precondition (T1557.003) and is operating-system agnostic, since it keys only on server behavior observed on the wire. Winning the race lets an attacker intercept traffic via a hostile gateway/DNS, bypass a VPN (TunnelVision), or deliver a malformed response that exploits the client's DHCP parser for code execution.

Attempt to Deactivate an Okta Network Zone

Apr 10, 2026 · Use Case: Identity and Access Audit Data Source: Okta Use Case: Network Security Monitoring Tactic: Defense Evasion Resources: Investigation Guide ·

Share on:

Detects attempts to deactivate an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls.

Attempt to Delete an Okta Network Zone

Apr 10, 2026 · Use Case: Identity and Access Audit Data Source: Okta Use Case: Network Security Monitoring Tactic: Defense Evasion Resources: Investigation Guide ·

Share on:

Detects attempts to delete an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls.

Attempt to Modify an Okta Network Zone

Apr 10, 2026 · Use Case: Identity and Access Audit Data Source: Okta Use Case: Network Security Monitoring Tactic: Defense Evasion Resources: Investigation Guide ·

Share on:

Detects attempts to modify an Okta network zone. Okta network zones can be configured to limit or restrict access to a network based on IP addresses or geolocations. An adversary may attempt to modify, delete, or deactivate an Okta network zone in order to remove or weaken an organization's security controls.

AWS EC2 Full Network Packet Capture Detected

Apr 10, 2026 · Domain: Cloud Data Source: AWS Data Source: Amazon Web Services Data Source: AWS EC2 Use Case: Network Security Monitoring Tactic: Exfiltration Tactic: Collection Resources: Investigation Guide ·

Share on:

Detects successful creation of an Amazon EC2 Traffic Mirroring session. A session copies full packets from a source Elastic Network Interface (ENI) to a mirror target (e.g., an ENI or NLB) using a mirror filter (ingress/egress rules). While used for diagnostics and NDR/IDS tooling, adversaries can abuse sessions to covertly capture and exfiltrate sensitive, potentially unencrypted, traffic from instances or subnets.

AWS EC2 Route Table Modified or Deleted

Apr 10, 2026 · Domain: Cloud Data Source: AWS Data Source: Amazon Web Services Data Source: AWS EC2 Use Case: Network Security Monitoring Resources: Investigation Guide Tactic: Persistence ·

Share on:

Identifies AWS CloudTrail events where an EC2 route table or association has been modified or deleted. Route table or association modifications can be used by attackers to disrupt network traffic, reroute communications, or maintain persistence in a compromised environment. This is a New Terms rule that detects the first instance of this behavior by a user or role.

Azure VNet Firewall Front Door WAF Policy Deleted

Apr 10, 2026 · Domain: Cloud Data Source: Azure Use Case: Network Security Monitoring Tactic: Defense Evasion Resources: Investigation Guide ·

Share on:

Identifies the deletion of a Frontdoor Web Application Firewall (WAF) Policy in Azure. An adversary may delete a Frontdoor Web Application Firewall (WAF) Policy in an attempt to evade defenses and/or to eliminate barriers to their objective.

Azure VNet Firewall Policy Deleted

Apr 10, 2026 · Domain: Cloud Data Source: Azure Use Case: Network Security Monitoring Tactic: Defense Evasion Resources: Investigation Guide ·

Share on:

Identifies the deletion of a firewall policy in Azure. An adversary may delete a firewall policy in an attempt to evade defenses and/or to eliminate barriers to their objective.

Azure VNet Network Watcher Deleted

Apr 10, 2026 · Domain: Cloud Data Source: Azure Use Case: Network Security Monitoring Tactic: Defense Evasion Resources: Investigation Guide ·

Share on:

Identifies the deletion of a Network Watcher in Azure. Network Watchers are used to monitor, diagnose, view metrics, and enable or disable logs for resources in an Azure virtual network. An adversary may delete a Network Watcher in an attempt to evade defenses.

Potential Network Sweep Detected

Apr 1, 2026 · Domain: Network Tactic: Discovery Tactic: Reconnaissance Use Case: Network Security Monitoring Data Source: PAN-OS Resources: Investigation Guide ·

Share on:

This rule identifies a potential network sweep. A network sweep is a method used by attackers to scan a target network, identifying active hosts, open ports, and available services to gather information on vulnerabilities and weaknesses. This reconnaissance helps them plan subsequent attacks and exploit potential entry points for unauthorized access, data theft, or other malicious activities. This rule defines a threshold-based approach to detect multiple connection attempts from a single host to numerous destination hosts over commonly used network services.

Potential Network Scan Detected

Feb 25, 2026 · Domain: Network Tactic: Discovery Tactic: Reconnaissance Use Case: Network Security Monitoring Data Source: PAN-OS Resources: Investigation Guide ·

Share on:

This rule identifies a potential port scan from an internal IP address. A port scan is a method utilized by attackers to systematically scan a target system for open ports, allowing them to identify available services and potential vulnerabilities. By mapping out the open ports, attackers can gather critical information to plan and execute targeted attacks, gaining unauthorized access, compromising security, and potentially leading to data breaches, unauthorized control, or further exploitation of the targeted system. This rule defines a threshold-based approach to detect connection attempts from a single internal source to a wide range of destination ports on a single destination.

Potential SYN-Based Port Scan Detected

Feb 25, 2026 · Domain: Network Tactic: Discovery Tactic: Reconnaissance Use Case: Network Security Monitoring Data Source: PAN-OS Resources: Investigation Guide ·

Share on:

This rule identifies a potential SYN-Based port scan. A SYN port scan is a technique employed by attackers to scan a target network for open ports by sending SYN packets to multiple ports and observing the response. Attackers use this method to identify potential entry points or services that may be vulnerable to exploitation, allowing them to launch targeted attacks or gain unauthorized access to the system or network, compromising its security and potentially leading to data breaches or further malicious activities. This rule defines a threshold-based approach to detect connection attempts from a single source to a large number of unique destination ports, while limiting the number of packets per port.

Deprecated - Azure Virtual Network Device Modified or Deleted

Jul 14, 2025 · Domain: Cloud Data Source: Azure Use Case: Network Security Monitoring Tactic: Impact Resources: Investigation Guide ·

Share on:

Identifies when a virtual network device is modified or deleted. This can be a network virtual appliance, virtual hub, or virtual router.

Deprecated Notice - This rule has been deprecated in favor of other rules that provide more contextual threat behavior for Azure Virtual Network.