Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
654 detections
Filters
Last updated
All Time
Detection languages
268
246
33
31
27
Contributors
207
128
118
98
20
Categories
20,443
11,831
5,872
5,155
4,866
654
Platforms
430
208
97
32
29
Products / Services
270
154
77
73
40
MITRE Techniques
326
308
201
105
97
CVEs
5
2
2
1
1
IDS Classtypes
177
67
11
9
3
IDS Protocols
129
108
16
7
3
Supplier Chain Page Enumeration
Suricata
This rule detects potential enumeration of supplier-related pages on a web server. It triggers when a client makes 15 or more HTTP requests containing the case-insensitive string "supplier" in the URI within a 30-second window. This behavior could indicate an attacker attempting to discover sensitive information or entry points related to an organization's supply chain.
This rule detects bulk access to the 'about-us' page on a web server. It triggers an alert if a single source IP makes 15 or more HTTP requests containing 'about-us' in the URI within a 30-second window. This behavior can indicate reconnaissance activity, where an attacker is rapidly enumerating or scraping information from a company's public-facing web pages.
This rule detects bulk scraping of 'team' or 'roles' pages on a web server. It triggers an alert if a client makes 15 or more HTTP requests containing 'team' (case-insensitive) in the URI within a 30-second window. This behavior is indicative of reconnaissance activities, specifically collecting information about an organization's structure or personnel.
This rule detects potential scraping activity targeting LinkedIn job listings. It triggers an alert when a single source IP makes 20 or more HTTP requests to 'linkedin.com' with a URI containing '/jobs/' within a 60-second window. This behavior could indicate an automated script or tool attempting to collect job information for various purposes, including competitive intelligence, data aggregation, or reconnaissance.
This rule detects enumeration of job listing pages on web servers, likely for tech stack reconnaissance. It triggers when a client makes 15 or more HTTP requests containing 'jobs' in the URI within a 30-second window to the same server. This behavior can indicate an attacker attempting to gather information about an organization's technology stack by analyzing job descriptions, which often mention specific software, systems, or programming languages.
This rule detects potential reconnaissance activity involving scraping LinkedIn company overview pages. It triggers when a client makes 10 or more HTTP requests to 'linkedin.com' with a URI containing '/about/' within a 60-second window. This pattern suggests automated or rapid collection of public company information from LinkedIn.
This rule detects repeated access attempts to web pages containing 'annual-report' in the URI. It triggers an alert if a single source IP makes 5 such requests within a 30-second window. This could indicate reconnaissance activity by an attacker looking for publicly available financial information.
This rule detects automated collection of organizational profile information characterized by a high rate of HTTP GET requests originating from specific user agents commonly associated with web scraping tools. It triggers an alert if a source IP makes 30 or more HTTP GET requests within a 20-second window, using user agents like 'python-requests', 'scrapy', 'curl', 'wget', or 'Go-http-client'. This behavior is indicative of reconnaissance activities, potentially for data exfiltration or vulnerability scanning.
SNMP Bulk Walk Enumeration
Suricata
This rule detects SNMP Bulk Walk Enumeration attempts. It triggers when UDP traffic on port 161 (SNMP) contains the case-insensitive string "private" and exceeds a threshold of 10 occurrences from the same source IP within 30 seconds. This activity is indicative of an adversary performing reconnaissance to gather information about network devices.
This rule detects attempts to enumerate SNMP community strings by looking for UDP traffic on port 161 containing the string "public" (case-insensitive). It uses a threshold of 10 occurrences within 30 seconds from the same source IP to identify potential scanning activity.
This rule detects DNS ANY record queries, which can be used for reconnaissance purposes. An ANY record query (QTYPE=255 or 0xFF) requests all available record types for a given domain. While legitimate uses exist, it is often abused by attackers to gather extensive information about a target's DNS infrastructure, making it a common indicator of reconnaissance activity.
This rule detects a DNS reverse lookup sweep, which is characterized by a high volume of DNS queries for reverse IP addresses (in-addr.arpa) within a short period. Specifically, it triggers an alert if 20 such queries are observed from a single source IP within 30 seconds. This activity is often indicative of reconnaissance efforts by an attacker to map out internal network infrastructure.
This rule detects the use of the SQLMap automated SQL injection tool by identifying the string "sqlmap" in the HTTP User-Agent header of network traffic. It specifically looks for traffic flowing to the server on established connections.
Wfuzz Directory Scanner Detected
Suricata
This rule detects the use of Wfuzz, a web fuzzer, by identifying the 'Wfuzz' string in the HTTP User-Agent header. This activity is typically associated with reconnaissance, as attackers use such tools to discover directories, files, and other web application structures.
Nikto Web Scanner Detected
Suricata
This rule detects the use of the Nikto web scanner by identifying the 'Nikto' string in the HTTP User-Agent header. Nikto is a common open-source web server scanner that performs comprehensive tests against web servers for multiple items, including dangerous files/CGIs, outdated server software, and other problems. Detection of Nikto typically indicates reconnaissance activity against a web application or server.
This rule detects attempts to fingerprint web applications by identifying the 'WhatWeb' string in the HTTP User-Agent header. WhatWeb is a web application scanner that identifies technologies used by websites, which can be an indicator of reconnaissance activity.
This rule detects attempts to discover Group Policy information remotely over Server Message Block (SMB). It specifically looks for network traffic on port 445 (SMB) containing the strings "SYSVOL" and "GroupPolicy" (case-insensitive) in the same flow, indicating a potential query for Group Policy objects.
LDAP Password Policy Enumeration
Suricata
This rule detects attempts to enumerate LDAP password policy settings by looking for specific content within TCP traffic on port 389 (LDAP). Specifically, it triggers when it finds "(objectClass=domain)" and "pwdHistoryLength" in a case-insensitive manner within the network flow, indicating a query for password history length attribute of a domain object. This activity is often associated with reconnaissance or discovery phases of an attack.
This rule detects ICMP (Internet Control Message Protocol) packets that are characteristic of a traceroute operation, specifically those with a Time-To-Live (TTL) value less than 5. Traceroute is a network diagnostic tool used to display the route and measure transit delays of packets across an Internet Protocol (IP) network. Adversaries can use this technique for network topology discovery to map out the network infrastructure.
UDP Traceroute Network Discovery
Suricata
This rule detects UDP traceroute network discovery attempts. It triggers an alert when UDP packets with a Time-To-Live (TTL) value less than 5 are observed, with a threshold of 10 such events from the same source within 10 seconds. This behavior is indicative of network scanning to map network topology.
This rule detects HTTP requests attempting to access the AWS EC2 Instance Metadata service, specifically targeting the 'latest/meta-data' endpoint. This service, typically found at the IP address 169.254.169.254, provides information about the running EC2 instance, including credentials and other sensitive data. Unauthorized access to this endpoint can indicate an attacker attempting to gain further access or information within an AWS environment.
Page 26 of 32