SNMP Default Community String Access
This rule detects attempts to access SNMP (Simple Network Management Protocol) services on the home network using the default community string 'public'. It specifically looks for the string 'public' within TCP traffic destined for port 161 (the standard SNMP port). A threshold of 5 attempts within 30 seconds from the same source IP will trigger an alert, indicating potential brute-force or reconnaissance activity against SNMP devices.
Suricata
