Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
654 detections
Filters
Last updated
All Time
Detection languages
268
246
33
31
27
Contributors
207
128
118
98
20
Categories
20,443
11,831
5,872
5,155
4,866
654
Platforms
430
208
97
32
29
Products / Services
270
154
77
73
40
MITRE Techniques
326
308
201
105
97
CVEs
5
2
2
1
1
IDS Classtypes
177
67
11
9
3
IDS Protocols
129
108
16
7
3
This rule detects attempts to harvest physical location data via web requests. It specifically looks for HTTP GET requests where the URI contains both 'location' and 'address' (case-insensitive). A threshold of 15 such requests within 30 seconds from the same source IP triggers the alert, indicating a potential network scan or automated data collection activity.
This rule detects attempts to enumerate domain trust relationships using LDAP queries. Specifically, it looks for TCP traffic on port 389 (LDAP) containing the string "(objectClass=trustedDomain)" in the server-bound flow. This string is commonly used in LDAP queries to discover trusted domains within an Active Directory environment, which can be a reconnaissance step for attackers.
Robots.txt Discovery Access
Suricata
This rule detects HTTP requests for '/robots.txt'. This file is commonly accessed by automated tools and attackers during the reconnaissance phase to understand a website's structure and identify disallowed paths. The detection is based on the URI content and is classified as a network scan.
This rule detects network traffic where the HTTP referer header contains "web.archive.org". This indicates that a user on the internal network is navigating to a website via a link from the Wayback Machine, which could be a sign of reconnaissance activity, where an attacker or insider is researching past versions of a website or looking for historical information that might no longer be publicly available on the live site. The rule specifically looks for established HTTP connections flowing to the server.
This rule detects automated web crawlers by identifying a high rate of HTTP GET requests from a single source IP address to the home network. Specifically, it triggers an alert if a source IP makes 100 or more GET requests within a 30-second window.
This rule detects bulk scraping of LinkedIn company profiles. It triggers when a client makes 20 or more HTTP requests to 'linkedin.com' with a URI containing '/company/' within a 60-second window. This behavior is indicative of automated tools attempting to extract large amounts of public company data from LinkedIn.
This rule detects attempts to access a web page on an IoT device that contains both 'about' and 'firmware' in its URI, case-insensitively. This could indicate an attacker or researcher attempting to discover firmware details or disclosure pages on IoT devices, potentially as part of a reconnaissance effort.
This rule detects attempts to enumerate firmware versions using SNMP. It specifically looks for TCP traffic on port 161 (SNMP) containing the string "sysDescr" (case-insensitive). A threshold is applied to trigger an alert if 5 such events are observed from the same source IP within a 30-second window, indicating a potential network scan for device information.
This rule detects attempts to discover the origin server behind a Content Delivery Network (CDN). It triggers when an HTTP request is made to a host containing "cdn" (case-insensitive) and the URI contains "origin" (case-insensitive). This behavior is indicative of reconnaissance activities where an attacker tries to bypass CDN protections to directly target the backend server.
This rule detects a full privileged port range scan. It triggers an alert if a source IP sends 200 TCP SYN packets to ports 0-1024 on the home network within a 10-second window. This behavior is indicative of an attacker attempting to discover open services on well-known ports.
This rule detects attempts to discover the 'security.txt' file on a web server. The 'security.txt' file is a proposed standard for security researchers to easily find contact information for reporting security vulnerabilities. Attackers or reconnaissance tools might look for this file to identify potential targets or gather information about an organization's security posture.
This rule detects potential career page scraping activity, which could be an indicator of reconnaissance by an attacker. It triggers when a client makes 15 or more HTTP requests containing 'careers' in the URI within a 30-second window, suggesting automated or rapid browsing of career-related pages.
This rule detects bulk access to web pages containing the term 'press' in their URI, indicating potential business intelligence gathering or reconnaissance activity. It triggers an alert if a single source IP makes 20 or more such requests within a 30-second window.
This rule detects a timing reconnaissance attempt against a web server, specifically looking for repeated HTTP requests to URIs containing both 'news' and 'events' (case-insensitive). The threshold of 20 requests within 30 seconds from the same source IP suggests an automated or rapid enumeration attempt to potentially infer information about the web server's response times or content availability.
This rule detects a potential client portfolio page enumeration by monitoring HTTP requests. It triggers an alert if a client makes 15 or more requests containing the string "clients" (case-insensitive) in the HTTP URI within a 30-second window. This behavior is indicative of an attacker attempting to discover or enumerate client-related pages or resources on a web server, possibly as part of a reconnaissance effort.
This rule detects repeated HTTP requests to a web server where the URI contains the case-insensitive string "headquarters". It triggers an alert if a single source IP makes 10 such requests within a 30-second window. This behavior is indicative of an automated attempt to scrape information related to a company's headquarters address, potentially for reconnaissance purposes.
This rule detects attempts to look up physical office locations via web requests. It specifically triggers on HTTP GET requests where the URI contains both 'office' and 'location' (case-insensitive). A threshold of 10 such requests from the same source within 30 seconds is set to reduce false positives.
This rule detects bulk enumeration of a company's overview page by monitoring HTTP requests. It triggers an alert if a source IP makes 20 or more requests containing 'company' in the URI within a 30-second window, indicating a potential network scan or reconnaissance activity.
This Suricata rule detects C2 port hopping behavior by identifying a single source IP initiating 10 or more TCP SYN packets to different non-standard ports within a 30-second window. This pattern is indicative of command and control (C2) communication attempting to evade detection by frequently changing ports.
This rule detects network reconnaissance activity by identifying HTTP user-agent strings commonly associated with vulnerability scanners like Nmap or Masscan. It specifically looks for the string 'Nmap' within the HTTP user-agent header in traffic flowing from the internal network to a server.
This rule detects potential Global Catalog LDAP enumeration attempts. It triggers when a source IP makes 10 or more TCP connections to destination port 3268 (the default port for Global Catalog LDAP) within a 60-second window. This behavior can indicate an attacker attempting to discover information about users, groups, and computers within an Active Directory environment.
Page 28 of 32