Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
654 detections
Filters
Last updated
All Time
Detection languages
268
246
33
31
27
Contributors
207
128
118
98
20
Categories
20,443
11,831
5,872
5,155
4,866
654
Platforms
430
208
97
32
29
Products / Services
270
154
77
73
40
MITRE Techniques
326
308
201
105
97
CVEs
5
2
2
1
1
IDS Classtypes
177
67
11
9
3
IDS Protocols
129
108
16
7
3
This rule detects HTTP requests to the Azure Instance Metadata Service (IMDS) IP address (169.254.169.254) with the URI containing 'metadata/instance'. This activity indicates an attempt to discover information about the Azure virtual machine instance, which can be a legitimate administrative action or an adversary attempting to collect credentials and other sensitive data.
This rule detects an active IP block scan by monitoring TCP SYN packets. It triggers an alert if more than 100 SYN packets are observed from a single source IP address within a 10-second window, indicating a potential reconnaissance activity where an attacker is scanning a range of IP addresses to identify live hosts or open ports.
This rule detects a UDP port scan by identifying a high volume of UDP traffic from a single source IP address to various ports on the home network within a short time frame. Specifically, it triggers an alert if more than 50 UDP packets are observed from the same source within a 10-second window, indicating a potential network reconnaissance activity.
This rule detects LDAP bind requests originating from an external source to a domain controller (port 389) within the home network. It specifically looks for the 'bindRequest' content in TCP traffic and triggers an alert if 10 such requests are observed from the same source within a 30-second window. This could indicate an attempt to enumerate or authenticate against directory services from outside the internal network, potentially as part of initial access or reconnaissance.
Detects possible TCP SYN port scanning activity by identifying a high volume of SYN packets from a single source within a short time window, which is commonly associated with reconnaissance tools like Nmap.
This rule detects potential staff directory scraping by monitoring HTTP GET requests to URIs containing the word "staff". It triggers an alert if more than 20 such requests are observed from a single source IP within a 30-second window, indicating automated or rapid enumeration attempts.
Executive Team Page Enumeration
Suricata
This rule detects repeated HTTP requests to URIs containing the word "executive" (case-insensitive) from a single source IP address within a 30-second window. This behavior could indicate an attempt to enumerate executive team pages, potentially for reconnaissance purposes.
This rule detects potential executive leadership directory scraping attempts. It triggers an alert when a client makes 10 or more HTTP requests containing the word "leadership" (case-insensitive) in the URI within a 30-second window. This behavior could indicate an attacker attempting to gather information about key personnel for social engineering or other reconnaissance purposes.
This rule detects enumeration attempts of partner and vendor pages on a web server. It triggers when a client makes 20 or more HTTP requests containing the case-insensitive string "partner" in the URI within a 30-second window, indicating a potential reconnaissance activity to discover sensitive or specific sections of a website.
This rule detects a potential network scan targeting firewall management interfaces. It specifically looks for TCP SYN packets (flags:S) directed to port 8443 on the home network, which is a common port for firewall management. The rule triggers if 5 such connection attempts are observed from the same source within a 60-second window, indicating a threshold-based scan.
This rule detects HTTP requests to known BGP route lookup services (bgp.he.net, bgpview.io, ipwhois.io). This activity is often associated with reconnaissance, specifically IP block discovery, where an attacker or red team member is gathering information about an organization's network infrastructure.
This rule detects network host discovery attempts via UDP sweeps. It triggers an alert when a single source IP sends 30 or more UDP packets within a 10-second window to various destinations on the home network. This behavior is indicative of an attacker attempting to map out active hosts on a network.
Sitemap File Discovery Access
Suricata
This rule detects HTTP requests to URIs that contain both 'sitemap' and '.xml' (case-insensitive). This pattern is commonly associated with the discovery of sitemap files, which are used by search engines to crawl websites. Attackers or reconnaissance tools might access these files to map out a website's structure and discover hidden or unlinked pages, which can then be used for further attacks.
This rule detects potential Google Dorking activity targeting a specific site. It triggers when a client makes 10 or more HTTP requests within 60 seconds to 'google.com' where the URI contains 'site:'. This pattern is indicative of an attacker or reconnaissance tool using Google's search operators to find information about a target domain.
This rule detects potential TLS client configuration fingerprinting activity. It triggers an alert when a client sends 20 or more TLS Server Name Indication (SNI) requests to a server within a 30-second window. This behavior can be indicative of reconnaissance activities where an attacker is attempting to identify services or configurations on a target network by observing TLS handshakes.
This rule detects HTTP requests to a web server that contain both 'firmware' and 'version' in the URI, case-insensitively. This pattern is often associated with attempts to access router firmware version information pages, which could be part of reconnaissance activities.
This rule detects an SNMP Hardware MIB Enumeration Walk. It triggers when a TCP connection to port 161 (SNMP) on the home network contains the byte sequence "30 82" at a depth of 2 bytes. A threshold is set to trigger an alert if 20 such events occur within 30 seconds from the same source IP address. This activity is classified as a network scan, specifically reconnaissance, as it involves querying SNMP for hardware information.
This rule detects attempts to enumerate hardware asset inventory information via web requests. It triggers when HTTP requests contain both 'asset' and 'inventory' in the URI, indicating a potential reconnaissance activity to gather information about an organization's hardware assets. A threshold of 10 such requests within 60 seconds from the same source IP is set to reduce false positives.
This rule detects web path fuzzing activity by identifying the 'dirsearch' string in the HTTP User-Agent header. Dirsearch is a common tool used for discovering web directories and files, often employed in reconnaissance phases of attacks or security assessments.
This rule detects HTTP traffic where the User-Agent header contains the string "Burp" (case-insensitive). This is indicative of traffic generated by Burp Suite, a popular web vulnerability scanner and proxy tool. The rule specifically looks for traffic flowing from the internal network to a server.
High Port Range Scan Detected
Suricata
This rule detects a high port range scan by monitoring TCP connections with the SYN flag set (indicating a new connection attempt) to ports within the high range (1025-65535) on the home network. It triggers an alert if more than 200 such connection attempts are observed from a single source IP address within a 10-second window.
Page 25 of 32