Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9 detections
Filters
Last updated
All Time
Detection languages
5
4
Contributors
9
Categories
5
5
5
4
4
Platforms
9
Products / Services
5
4
4
MITRE Techniques
5
5
5
5
4
CVEs
71
71
64
58
49
IDS Classtypes
4
IDS Protocols
4
Detects potential unauthenticated Remote Code Execution (RCE) exploitation attempts targeting the IKEv2/ISAKMP VPN service on WatchGuard Firebox devices (CVE-2025-14733). The rule monitors UDP traffic on standard IKE ports 500 and 4500, looking for specific payload patterns and elevated data sizes consistent with exploitation attempts, coupled with a threshold to reduce noise.
Detects potential unauthenticated Remote Code Execution (RCE) exploitation attempts targeting the IKEv2/ISAKMP VPN service on WatchGuard Firebox devices (CVE-2025-14733). The rule monitors UDP traffic on standard IKE ports 500 and 4500, looking for specific payload patterns and elevated data sizes consistent with exploitation attempts, coupled with a threshold to reduce noise.
Detects potential unauthenticated Remote Code Execution (RCE) exploitation attempts targeting the IKEv2/ISAKMP VPN service on WatchGuard Firebox devices (CVE-2025-14733). The rule monitors UDP traffic on standard IKE ports 500 and 4500, looking for specific payload patterns and elevated data sizes consistent with exploitation attempts, coupled with a threshold to reduce noise.
Detects instances where the outbound byte count to external (non-private) IP addresses for a source host significantly exceeds its historical hourly baseline. This detection is designed to identify potential data exfiltration stages occurring after system or network compromise.
Detects potential unauthenticated Remote Code Execution (RCE) exploitation attempts targeting the IKEv2/ISAKMP VPN service on WatchGuard Firebox devices (CVE-2025-14733). The rule monitors UDP traffic on standard IKE ports 500 and 4500, looking for specific payload patterns and elevated data sizes consistent with exploitation attempts, coupled with a threshold to reduce noise.
Detects instances where the outbound byte count to external (non-private) IP addresses for a source host significantly exceeds its historical hourly baseline. This detection is designed to identify potential data exfiltration stages occurring after system or network compromise.
Detects instances where the outbound byte count to external (non-private) IP addresses for a source host significantly exceeds its historical hourly baseline. This detection is designed to identify potential data exfiltration stages occurring after system or network compromise.
Detects instances where the outbound byte count to external (non-private) IP addresses for a source host significantly exceeds its historical hourly baseline. This detection is designed to identify potential data exfiltration stages occurring after system or network compromise.
Detects instances where the outbound byte count to external (non-private) IP addresses for a source host significantly exceeds its historical hourly baseline. This detection is designed to identify potential data exfiltration stages occurring after system or network compromise.