Zeek
Telemetry Evidence
These values show how indexed rules identify Zeek telemetry.Elastic
logs-zeek.* logs-zeek.http* logs-zeek.http-* zeek Panther
Zeek.DNS zeek Sigma
zeek Splunk
Zeek Conn YARA-L
crowdstrike, gcp firewall, microsoft sysmon, gcp scc, microsoft defender atp, corelight zeek, microsoft windows events microsoft windows , gcp firewall, microsoft sysmon, crowdstrike, gcp scc, zeek
Detection Rules
Elastic #
- Abnormally Large DNS Response source medium: Specially crafted DNS requests can manipulate a known overflow vulnerability in some Windows DNS servers, resulting in Remote Code Execution (RCE) or a Denial of Service (DoS) from crashing the service.
T1210,T1499,T1499.004 - Newly Observed IPSEC NAT Traversal Peer source low: This rule identifies outbound IPSEC NAT Traversal (NAT-T) traffic to an external destination IP that was not observed during the previous 5 days. IPSEC is a VPN technology that allows one system to talk to another using encrypted tunnels. NAT Traversal encapsulates IPSEC ESP traffic in UDP and, once a NAT device is detected, both peers float to UDP port 4500 for the tunnel data channel. Newly observed external NAT-T peers may indicate unauthorized VPN use or an adversary tunneling command and control or exfiltration traffic over the Internet.
T1095,T1572,T1573 - Potential cPanel WHM CRLF Authentication Bypass (CVE-2026-41940) source high: Identifies the network signature of CVE-2026-41940, a pre-auth root-level authentication bypass in cPanel and WebHost Manager (WHM) caused by a CRLF injection in the session writer. The exploit-inherent shape on the wire is a "GET /" request to a cPanel/WHM admin port (typically TCP/2087, 2086, 2083, 2082, 2095, 2096) carrying an "Authorization: Basic" header whose base64-decoded value contains CRLF-injected session fields, which causes cpsrvd to respond with a 3xx redirect whose "Location" header leaks a "/cpsessNNNNNNNNNN" token granting the attacker a privileged session. This is the network-layer equivalent of the cPanel "access_log" artifact identified by Unfold and watchTowr as the first bulletproof detection for this CVE: a "GET /" recorded with "auth_method=b" (HTTP Basic). Legitimate access to "GET /" on a WHM admin port returns 200 with the login screen and never includes HTTP Basic credentials, so this combination is not produced by normal use.
T1190 - Potential DNS Rebinding from Public to Private Address source medium: Identifies a client resolving the same public registered domain to both a public IP address and a private, loopback, link-local, unique-local IPv6, or shared address. This includes both address classes being observed at the same timestamp, and a public answer followed within five minutes by a private answer where the minimum TTL across all answer records in the private-answer events is 60 seconds or less. Either pattern is consistent with DNS rebinding that pivots browser or application trust to internal resources.
T1189 - Potential DNS Tunneling via Long and Unique Subdomains source medium: Identifies a client generating many unique, unusually long DNS query names to the same registered domain within a five-minute window. Malware DNS tunnels and DNS command-and-control commonly encode data in lengthy subdomain portions under one apex domain.
T1048,T1048.003,T1071,T1071.004,T1572 - RDP (Remote Desktop Protocol) from the Internet source medium: This rule detects network events that may indicate the use of RDP traffic from the Internet. RDP is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.
T1021,T1021.001,T1133,T1190 - RPC (Remote Procedure Call) from the Internet source high: This rule detects network events that may indicate the use of RPC traffic from the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.
T1133,T1190 - RPC (Remote Procedure Call) to the Internet source high: This rule detects network events that may indicate the use of RPC traffic to the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.
T1021,T1021.003,T1190 - SMB (Windows File Sharing) Activity from the Internet source high: This rule detects network events that may indicate inbound Windows file sharing (SMB or CIFS) traffic originating from the Internet. SMB should never be directly reachable from the Internet, as it is a primary target for exploitation by threat actors seeking initial access. Inbound SMB from a public IP is a direct precondition for attacks such as EternalBlue (MS17-010) and related SMB remote code execution vulnerabilities.
T1133,T1190 - SMB (Windows File Sharing) Activity to the Internet source medium: This rule detects network events that may indicate the use of Windows file sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly used within networks to share files, printers, and other system resources amongst trusted systems. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector or for data exfiltration.
T1048,T1190
Show 5 more
- SMTP to the Internet on Port 26/TCP source low: This rule detects events that may indicate use of SMTP on TCP port 26 from an internal host to an external destination. This port is commonly used by several popular mail transfer agents to deconflict with the default SMTP port 25. This port has also been used by a malware family called BadPatch for command and control of Windows systems. The rule is scoped to outbound traffic (internal source to external destination) to focus on the command and control and exfiltration use cases, rather than benign internal mail relays or unrelated transit traffic observed by the sensor.
T1048,T1071,T1071.003,T1571 - Splunk Enterprise PostgreSQL Backup-to-Restore Potential RCE Sequence source medium: Detects a POST to the Splunk Enterprise PostgreSQL backup endpoint followed by a POST to the restore endpoint from the same client to the same host within a 15-minute window. This sequence is unusual and can align with the public CVE-2026-20253 pre-authentication RCE chain, where an attacker stages a database dump via the backup path and executes attacker-controlled SQL via the restore path.
T1190 - Splunk Enterprise PostgreSQL Recovery Endpoint Injection Artifacts source high: Detects CVE-2026-20253 exploit artifacts against the Splunk Enterprise PostgreSQL sidecar recovery endpoints via complementary signals. Where endpoint or Network Packet Capture request-body logging is available, the rule matches PostgreSQL connection-string injection keywords, suspicious
backupFiledestinations, and known filesystem artifacts used to pivot from backup/restore primitives to file write or RCE. It also detects vulnerable recovery endpoint probing and empty-password Basic auth credentials observed in public exploit tooling.T1190 - Web Server Cloud Metadata SSRF Request source medium: Detects HTTP requests to web servers whose URL or query string references cloud instance metadata endpoints or equivalent encoded variants. Attackers exploit server-side request forgery (SSRF) vulnerabilities in web applications to reach link-local metadata services on AWS, GCP, Azure, and similar cloud providers and harvest temporary credentials, tokens, or instance details.
T1190,T1552,T1552.005 - Web Server Potential SQL Injection Request source high: This rule detects potential SQL injection attempts in web server requests by identifying common SQL injection patterns in URLs. Such activity may indicate reconnaissance or exploitation attempts by attackers trying to manipulate backend databases or extract sensitive information.
T1059,T1059.004,T1071,T1190,T1505,T1595
Panther #
- Malicious SSO DNS Lookup source medium: The rule looks for DNS requests to sites potentially posing as SSO domains.
T1566
Sigma #
- Default Cobalt Strike Certificate source high: Detects the presence of default Cobalt Strike certificate in the HTTPS traffic
- DNS Events Related To Mining Pools source low: Identifies clients that may be performing DNS lookups associated with common currency mining pools.
T1496,T1569,T1569.002 - DNS TOR Proxies source medium: Identifies IPs performing DNS lookups associated with common Tor proxies.
T1048 - Executable from Webdav source medium: Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/
T1105 - First Time Seen Remote Named Pipe - Zeek source high: This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes
T1021,T1021.002 - HTTP Request to Low Reputation TLD or Suspicious File Extension source medium: Detects HTTP requests to low reputation TLDs (e.g. .xyz, .top, .ru) or ending in suspicious file extensions (.exe, .dll, .hta), which may indicate malicious activity.
- Katz Stealer Suspicious User-Agent source high: Detects network connections with a suspicious user-agent string containing "katz-ontop", which may indicate Katz Stealer activity.
T1071,T1071.001 - Kerberos Network Traffic RC4 Ticket Encryption source medium: Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting
T1558,T1558.003 - MITRE BZAR Indicators for Execution source medium: Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE
T1047,T1053,T1053.002,T1569,T1569.002 - MITRE BZAR Indicators for Persistence source medium: Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.
T1547,T1547.004
Show 14 more
- New Kind of Network (NKN) Detection source low: NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are legitimate uses for it, it can also be used as a C2 channel. This rule looks for a DNS request to the ma>
- OMIGOD HTTP No Authentication RCE - CVE-2021-38647 source high: Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.
T1021,T1021.006,T1068,T1190,T1203,T1210 - Possible Impacket SecretDump Remote Activity - Zeek source high: Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml
T1003,T1003.002,T1003.003,T1003.004 - Possible PrintNightmare Print Driver Install - CVE-2021-1675 source medium: Detects the remote installation of a print driver which is possible indication of the exploitation of PrintNightmare (CVE-2021-1675). The occurrence of print drivers being installed remotely via RPC functions should be rare, as print drivers are normally installed locally and or through group policy.
- Potential PetitPotam Attack Via EFS RPC Calls source medium: Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack refereed to as PetitPotam. The usage of this RPC function should be rare if ever used at all. Thus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation to determine if it is legitimate. View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'
T1187,T1557,T1557.001 - Publicly Accessible RDP Service source high: Detects connections from routable IPs to an RDP listener. Which is indicative of a publicly-accessible RDP service.
T1021,T1021.001 - Remote Task Creation via ATSVC Named Pipe - Zeek source medium: Detects remote task creation via at.exe or API interacting with ATSVC namedpipe
T1053,T1053.002 - SMB Spoolss Name Piped Usage source medium: Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.
T1021,T1021.002 - Suspicious Access to Sensitive File Extensions - Zeek source medium: Detects known sensitive file extensions via Zeek
- Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network source high: Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.
T1187,T1557,T1557.001 - Suspicious DNS Z Flag Bit Set source medium: The DNS Z flag is bit within the DNS protocol header that is, per the IETF design, meant to be used reserved (unused). Although recently it has been used in DNSSec, the value being set to anything other than 0 should be rare. Otherwise if it is set to non 0 and DNSSec is being used, then excluding the legitimate domains is low effort and high reward. Determine if multiple of these files were accessed in a short period of time to further enhance the possibility of seeing if this was a one off or the possibility of larger sensitive file gathering. This Sigma query is designed to accompany the Corelight Threat Hunting Guide, which can be found here: https://www3.corelight.com/corelights-introductory-guide-to-threat-hunting-with-zeek-bro-logs'
T1095,T1571 - Suspicious PsExec Execution - Zeek source high: detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one
T1021,T1021.002 - Transferring Files with Credential Data via Network Shares - Zeek source medium: Transferring files with well-known filenames (sensitive files with credential data) using network shares
T1003,T1003.001,T1003.002,T1003.003 - WebDav Put Request source low: A General detection for WebDav user-agent being used to PUT files on a WebDav network share. This could be an indicator of exfiltration.
T1048,T1048.003
Splunk #
- Remote Desktop Network Traffic source low: The following analytic detects unusual Remote Desktop Protocol (RDP) traffic on TCP/3389 by filtering out known RDP sources and destinations, focusing on atypical connections within the network. This detection leverages network traffic data to identify potentially unauthorized RDP access. Monitoring this activity is crucial for a SOC as unauthorized RDP access can indicate an attacker's attempt to control networked systems, leading to data theft, ransomware deployment, or further network compromise. If confirmed malicious, this activity could result in significant data breaches or complete system and network control loss.
T1021,T1021.001
YARA-L #
- IP Target Prevalence source low: Detect events that are communicating to IP addresses that have a low rolling max prevalence.
- Network Connection First Seen In Past Day source low: Detect network connection to an ip address that was only seen for the first time in the past 24 hours