Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6 detections
Filters
Last updated
All Time
Detection languages
6
Contributors
5
1
Categories
6
6
5
1
1
Platforms
6
6
Products / Services
6
6
3
MITRE Techniques
4
4
3
3
3
CVEs
71
71
64
58
49
IDS Classtypes
5
1
IDS Protocols
6
Detects network activity related to the exploitation of the CVE-2025-31702 vulnerability in Dahua P2P Relay services. The rules monitor for probe attempts, device parameter fetching (randsalt), serial number enumeration bursts, and successful no-auth channel responses, indicating a bypass of authentication mechanisms on vulnerable Dahua devices.
Detects network activity related to the exploitation of the CVE-2025-31702 vulnerability in Dahua P2P Relay services. The rules monitor for probe attempts, device parameter fetching (randsalt), serial number enumeration bursts, and successful no-auth channel responses, indicating a bypass of authentication mechanisms on vulnerable Dahua devices.
Detects network traffic associated with exploitation attempts against Dahua P2P relay services. The rules monitor for specific URI patterns ('/online/p2psrv/' and '/probe/device/') used to probe the device, as well as traffic containing a hardcoded AES-OFB initialization vector, which indicates attempts to exploit CVE-2025-31702.
Detects high-frequency, unauthenticated probe requests targeting Dahua P2P relay endpoints (/probe/device/ and /online/p2psrv/). This activity is indicative of automated scanning, enumeration, or potential exploitation attempts related to CVE-2025-31702 against internet-facing or network-connected Dahua hardware.
Detects network activity related to the exploitation of Dahua P2P relay services via easy4ipcloud.com. The rule monitors for unauthorized device probing, serial number enumeration, and illicit relay authentication attempts (e.g., using DHP2P protocols and X-WSSE authentication), which are indicative of attackers attempting to abuse IoT device remote access functionality (CVE-2025-31702).
Detects network-based exploitation attempts against Dahua Easy4IP P2P relay infrastructure, including reconnaissance probes, unauthorized relay usage, and credential theft attempts via WSSE authentication.
