network:pcap
Packet capture / content
- Host type
- Network devices and network sensors
- Tier, as a whole
- Minimum
- Techniques
- 2
- Rules listed
- 91
- Events
- 0
Techniques
Rules
Splunk 8
- Cisco Smart Install Oversized Packet Detection
- Cisco Smart Install Port Discovery and Status
- Java Class File download by Java User Agent
- Log4Shell JNDI Payload Injection with Outbound Connection
- Multiple Archive Files Http Post Traffic
- Plain HTTP POST Exfiltrated Data
- Web Spring Cloud Function FunctionRouter
- Web Spring4Shell HTTP Request Class Module
Elastic 83
- Abnormally Large DNS Response
- Accepted Default Telnet Port Connection
- Anomalous Linux Compiler Activity
- Anomalous Process For a Linux Population
- Anomalous React Server Components Flight Data Patterns
- Azure WireServer HTTP Request from Unexpected User Agent
- Cassandra JavaScript UDF Creation
- Cloud Instance Metadata Credential Path HTTP Request
- Cobalt Strike Command and Control Beacon
- DNS Tunneling
- Default Cobalt Strike Team Server Certificate
- Deprecated TLS Version or Weak Cipher Negotiated Externally
- External Alerts
- First Seen External MQTT Broker Connection
- First Time Seen Memcached Writer
- First Time Seen NFS AUTH_SYS Root UID Access
- First Time Seen RMM Service Hostname from Network DNS
- First-Time Destructive MongoDB Command from a Client IP
- Halfbaked Command and Control Beacon
- ICMP Redirect Message from Internal Host
- ICMP Timestamp or Information Request from the Internet
- Inbound Connection to an Unsecure Elasticsearch Node
- Initial Access via File Upload Followed by GET Request
- Machine Learning Detected DGA activity using a known SUNBURST DNS domain
- Machine Learning Detected a DNS Request Predicted to be a DGA Domain
- Machine Learning Detected a DNS Request With a High DGA Probability Score
- Multiple DHCP Servers Responding to the Same Transaction
- Multiple RMM Vendors Queried by a Single DNS Client
- MySQL User-Defined Function Injection
- Network Traffic to Rare Destination Country
- Newly Observed IPSEC NAT Traversal Peer
- Possible FIN7 DGA Command and Control Behavior
- PostgreSQL COPY PROGRAM Command Execution
- Potential DGA Activity
- Potential DHCP Starvation via High Client MAC Cardinality
- Potential DNS Rebinding from Public to Private Address
- Potential DNS Tunneling via NULL or Long DNS Queries
- Potential Data Exfiltration Activity to an Unusual Destination Port
- Potential Data Exfiltration Activity to an Unusual IP Address
- Potential Data Exfiltration Activity to an Unusual ISO Code
- Potential Data Exfiltration Activity to an Unusual Region
- Potential ICMP Tunneling Activity to the Internet
- Potential NFS Destructive Operation Burst
- Potential Network Scan Detected
- Potential Network Sweep Detected
- Potential Redis CONFIG SET Cron Directory Persistence (RedisRaider)
- Potential Redis CONFIG SET SSH Authorized Key Injection
- Potential Redis Lua Use-After-Free RCE Attempt (CVE-2025-49844 / RediShell)
- Potential SIP Extension Enumeration
- Potential SIP REGISTER Brute Force
- Potential SYN-Based Port Scan Detected
- Potential Self-Signed TLS Certificate Recently Issued on External Connection
- Potential Toolshell Initial Exploit (CVE-2025-53770 & CVE-2025-53771)
- Potential VIEWSTATE RCE Attempt on SharePoint/IIS
- Potential Webshell Deployed via Apache Struts CVE-2023-50164 Exploitation
- Potential cPanel WHM CRLF Authentication Bypass (CVE-2026-41940)
- RDP (Remote Desktop Protocol) from the Internet
- RPC (Remote Procedure Call) from the Internet
- RPC (Remote Procedure Call) to the Internet
- Rapid7 Threat Command CVEs Correlation
- React2Shell (CVE-2025-55182) Exploitation Attempt
- Repeated Stalled TLS Handshakes via ALPN acme-tls/1 Extension
- Roshal Archive (RAR) or PowerShell File Downloaded from the Internet
- SMB (Windows File Sharing) Activity from the Internet
- SMB (Windows File Sharing) Activity to the Internet
- SMTP to the Internet on Port 26/TCP
- Spike in Firewall Denies
- Spike in Network Traffic
- Spike in Network Traffic To a Country
- Splunk Enterprise PostgreSQL Backup-to-Restore Potential RCE Sequence
- Splunk Enterprise PostgreSQL Recovery Endpoint Injection Artifacts
- Successful AMQP Multi-Queue Purge Burst
- Suspicious Network Activity to the Internet by Previously Unknown Executable
- Threat Intel IP Address Indicator Match
- Threat Intel URL Indicator Match
- Thrift RPC Method from an External Client
- Unusual DNS Activity
- Unusual Linux Network Activity
- Unusual Linux Network Port Activity
- Unusual Web Request
- Unusual Web User Agent
- VNC (Virtual Network Computing) from the Internet
- VNC (Virtual Network Computing) to the Internet
Events
No event-level rows: this source is tiered as a whole.