Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
381 detections
Filters
Last updated
All Time
Detection languages
380
1
Contributors
160
79
64
38
20
Categories
220
190
146
124
101
Platforms
325
56
56
48
11
Products / Services
362
188
33
20
19
MITRE Techniques
140
73
56
53
51
CVEs
12
9
9
5
5
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
189
154
25
4
4
This rule detects an anomaly in Kerberos Ticket Granting Ticket (TGT) requests. Specifically, it triggers an alert if more than 50 UDP Kerberos TGT requests are observed from a single source IP address within a 10-second window to the home network on port 88. This behavior could indicate an attempt to enumerate valid user accounts or perform credential stuffing/brute-force attacks against the Kerberos authentication system, potentially as part of a privilege escalation attempt (ATT&CK T1134).
This rule detects attempts to modify user accounts via LDAP. It specifically looks for TCP traffic on port 389 (LDAP) containing the hexadecimal representation of '0' (likely part of an LDAP message structure) and the case-insensitive string 'modify'. A threshold of 5 such events within 60 seconds from the same source IP triggers the alert, indicating potential malicious activity related to account manipulation.
This rule detects a password spraying attack targeting LDAP services. It triggers an alert if there are 50 or more TCP connections to port 389 (LDAP) on the home network within a 60-second window, originating from the same destination IP address. This pattern is indicative of an attacker attempting to authenticate with a small set of passwords against many accounts.
This rule detects internal Server Message Block (SMB) lateral movement attempts. It triggers when there are 10 or more SMB connections (identified by the "|FF|SMB" content signature) from a single source IP address to any destination on port 445 within a 60-second window, within the home network. This behavior is indicative of an attacker attempting to move laterally within a network using SMB.
ET WEB_SPECIFIC_APPS Monsta FTP Arbitrary File Upload Attempt (CVE-2025-34299)
ET WEB_SPECIFIC_APPS IPFire calamaris.dat Multiple Parameters Command Injection Attempt (CVE-2025-34311)
ET WEB_SPECIFIC_APPS ASMAX CGI script system Parameter Command Injection Attempt (CVE-2009-5156)
ET WEB_SPECIFIC_APPS IPFire urlfilter.cgi BE_NAME Parameter Command Injection Attempt (CVE-2025-34312)
ET WEB_SPECIFIC_APPS LILIN dvr_box Server Parameter Command Injection Attempt (CVE-2025-34132)
ET WEB_SPECIFIC_APPS Draytek recvCMD Command Injection Attempt (CVE-2024-41585)
ET WEB_SPECIFIC_APPS Ilevia mbus_build_from_csv.php Multiple Parameters Command Injection Attempt (CVE-2025-34513)
ET WEB_SPECIFIC_APPS Brickcom syslog.dump action Parameter Information Disclosure Attempt (CVE-2017-9238)
ET WEB_SPECIFIC_APPS ByteValue webRead/open path Parameter Command Injection Attempt (CVE-2023-7011)
ET WEB_SPECIFIC_APPS Syrotec/GPON shellCMDExec command Parameter Command Injection Attempt (CVE-2024-46658)
ET WEB_SPECIFIC_APPS D-Link myMusic.cgi Multiple Parameters Command Injection Attempt (CVE-2024-7922)
ET WEB_SPECIFIC_APPS D-Link SetWLanRadioSecurity Key Parameter Command Injection Attempt (CVE-2024-48634)
ET WEB_SPECIFIC_APPS Ivanti Connect Secure CRLF Injection Remote Code Execution Attempt (CVE-2024-37404)
ET WEB_SPECIFIC_APPS Guetebruck param.cgi group Parameter SQL Injection Attempt (CVE-2025-12463)
ET WEB_SPECIFIC_APPS IPFire ovpnclients.dat CONNECTION_NAME Parameter SQL Injection Attempt (CVE-2025-34304)
ET WEB_SPECIFIC_APPS Brickcom camerainfo.cgi a Parameter Information Disclosure Attempt (CVE-2017-9238)
ET WEB_SPECIFIC_APPS Brickcom configfile.dump action Parameter Information Disclosure Attempt (CVE-2017-9238)
Page 18 of 19