Every published rule

This rule detects strings used in command execution in DNS TXT Answer

This rule detects known sensitive file extensions via Zeek

This rule detects turn off logging locally or remote

This rule detects the presence of default Cobalt Strike certificate in the HTTPS traffic

This rule detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface. Disabling dot1x bypasses Network Access Control (NAC) mechanisms, potentially allowing unauthorized devices to gain access to the internal network. This behavior is a common method used by adversaries or hostile insiders to establish persistence or perform lateral movement via rogue devices.

This rule detects various protocols maybe used to put data on the device for exfil or infil

This rule detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if adversary uses a different psexec client other than sysinternal one

This rule detects show when a monitor or a span/rspan is setup or modified

This rule detects information about network devices that is not stored in config files

This rule detects windows DCE-RPC functions which indicate a persistence methods on the remote system. All credit for the Zeek mapping of the anomalous endpoint/operation field goes to MITRE.

This rule detects the DNS Z flag is bit within the DNS protocol header that is, per the IETF design, meant to be used reserved (unused). Although recently it has been used in DNSSec, the value being set to anything other than 0 should be rare. Otherwise if it is set to non 0 and DNSSec is being used, then excluding the legitimate domains is low effort and high reward. Determine if multiple of these files were accessed in a short period of time to further enhance the possibility of seeing if this was a one off or the possibility of larger sensitive file gathering. This Sigma query is designed to accompany the Corelight Threat Hunting Guide, that can be found here: https://www3.corelight.com/corelights-introductory-guide-to-threat-hunting-with-zeek-bro-logs'

This rule detects BGP failures which may be indicative of brute force attacks to manipulate routing

This rule detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting

This rule detects IPs performing DNS lookups linked with common Tor proxies.

This rule detects DNS queries to well-known out-of-band application security testing (OAST) and callback domains. These services (e.g. Burp Collaborator, interactsh, canarytokens, dnslog.cn) are used by security researchers and adversaries alike to confirm blind vulnerabilities such as SSRF, XXE, blind RCE, and Log4Shell-style injections, where the exploit payload triggers an external DNS lookup to a controlled domain. A detection suggests that a host on your network resolved one of these domains, which may mean: (1) an adversary is actively probing or exploiting a vulnerable service and using the callback to confirm code execution or data exfiltration, (2) a security scanner (e.g. Nuclei, Gobies) is running against internal targets. Investigate the source host, the full DNS query string (the unique subdomain prefix encodes the callback session), and any concurrent outbound connections or process behavior to determine intent.

This rule detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.

This rule detects a General detection for WebDav user-agent being used to PUT files on a WebDav network share. This could be an indicator of exfiltration.

This rule detects remote task creation via at.exe or API interacting with ATSVC namedpipe

This rule detects BGP failures which may be indicative of brute force attacks to manipulate routing.

This rule detects local accounts being created or modified as well as remote authentication configurations