Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18 detections
Filters
Last updated
All Time
Detection languages
12
6
Contributors
9
9
Categories
18
12
7
5
1
Platforms
18
18
Products / Services
12
12
6
MITRE Techniques
18
5
3
1
1
CVEs
71
71
64
58
49
18
IDS Classtypes
12
IDS Protocols
7
5
Detects anomalous activity on Dahua camera management interfaces (port 37777) where multiple failed authentication attempts are followed by administrative configuration actions without a corresponding successful credentialed login, suggesting exploitation of authentication-bypass vulnerabilities such as CVE-2021-33044 and CVE-2021-33045.
Detects network traffic attempting to exploit CVE-2021-33044, an authentication bypass vulnerability in Dahua NetKeyboard devices, by identifying specific login request strings used in the exploit chain.
Detects attempts to exploit CVE-2021-33044, an authentication bypass vulnerability in Dahua NetKeyboard hardware. The rule triggers when a POST request containing 'global.login', 'clientType: NetKeyboard', and 'loginType: Direct' is observed, which allows unauthorized access by manipulating authentication parameters.
Detects network traffic attempting to exploit the Dahua CVE-2021-33044 vulnerability, which allows an unauthenticated user to bypass authentication mechanisms on affected NetKeyboard devices.
This rule detects attempts to exploit CVE-2021-33044 in Dahua devices, specifically targeting the NetKeyboard clientType during the global.login RPC request. This vulnerability allows an unauthenticated remote attacker to bypass authentication mechanisms.
Detects network traffic attempting to exploit CVE-2021-33044, an authentication bypass vulnerability in Dahua NetKeyboard devices, by identifying specific login request strings used in the exploit chain.
Detects attempts to exploit CVE-2021-33044, an authentication bypass vulnerability in Dahua NetKeyboard hardware. The rule triggers when a POST request containing 'global.login', 'clientType: NetKeyboard', and 'loginType: Direct' is observed, which allows unauthorized access by manipulating authentication parameters.
This rule detects attempts to exploit CVE-2021-33044, a vulnerability in Dahua hardware that allows an attacker to bypass authentication by sending a specially crafted request to the global.login endpoint.
Detects network traffic attempting to exploit CVE-2021-33044 in Dahua NetKeyboard devices. The rule identifies specifically crafted 'global.login' requests designed to bypass authentication mechanisms.
Detects exploit attempts targeting the authentication bypass vulnerability in Dahua NetKeyboard devices (CVE-2021-33044) by monitoring HTTP requests containing malicious 'global.login' RPC parameters.
This rule detects attempts to exploit CVE-2021-33044, a vulnerability in Dahua hardware that allows an attacker to bypass authentication by sending a specially crafted request to the global.login endpoint.
This rule detects attempts to exploit CVE-2021-33044, a vulnerability in Dahua hardware that allows an attacker to bypass authentication by sending a specially crafted request to the global.login endpoint.
Detects network requests targeting Dahua devices that attempt to exploit CVE-2021-33044. The exploitation involves sending a crafted 'global.login' RPC call with specific parameters (clientType 'NetKeyboard', loginType 'Direct', authorityType 'Default') to bypass authentication and retrieve administrative session tokens.
This rule detects attempts to exploit CVE-2021-33044, a vulnerability in Dahua hardware that allows an attacker to bypass authentication by sending a specially crafted request to the global.login endpoint.
Detects network requests targeting Dahua devices that attempt to exploit CVE-2021-33044. The exploitation involves sending a crafted 'global.login' RPC call with specific parameters (clientType 'NetKeyboard', loginType 'Direct', authorityType 'Default') to bypass authentication and retrieve administrative session tokens.
Detects network requests targeting Dahua devices that attempt to exploit CVE-2021-33044. The exploitation involves sending a crafted 'global.login' RPC call with specific parameters (clientType 'NetKeyboard', loginType 'Direct', authorityType 'Default') to bypass authentication and retrieve administrative session tokens.
Detects network requests targeting Dahua devices that attempt to exploit CVE-2021-33044. The exploitation involves sending a crafted 'global.login' RPC call with specific parameters (clientType 'NetKeyboard', loginType 'Direct', authorityType 'Default') to bypass authentication and retrieve administrative session tokens.
Detects network requests targeting Dahua devices that attempt to exploit CVE-2021-33044. The exploitation involves sending a crafted 'global.login' RPC call with specific parameters (clientType 'NetKeyboard', loginType 'Direct', authorityType 'Default') to bypass authentication and retrieve administrative session tokens.