Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
118 detections
Filters
Last updated
All Time
Detection languages
117
1
Contributors
52
30
22
5
3
Categories
98
67
61
26
22
Platforms
102
27
19
6
6
Products / Services
113
102
14
3
2
MITRE Techniques
67
39
37
29
28
CVEs
4
4
3
2
1
IDS Classtypes
1,937
503
461
381
236
118
IDS Protocols
64
44
4
2
2
Detects network traffic consistent with automated penetration testing frameworks such as Nuclei, ffuf, or sqlmap. This rule monitors HTTP user-agent strings and triggers an alert if high-frequency scanning activity from a single source is observed within a 60-second window, which is indicative of automated reconnaissance or vulnerability scanning.
Detects high-frequency TCP SYN packet bursts targeting port 37777 (commonly used by Dahua surveillance devices). The detection triggers when more than 50 SYN packets from a single source are observed within a 10-second window, suggesting automated reconnaissance or vulnerability scanning activity.
This rule detects suspicious UDP traffic directed at port 8800 targeting the Dahua P2P cloud relay interface. It specifically monitors for enumeration attempts against device serial numbers, which may be a precursor to unauthorized access or reconnaissance against vulnerable Dahua devices.
Detects high-frequency TCP SYN scanning activity targeting port 37777, commonly associated with the discovery of vulnerable Dahua DVR and NVR devices.
Detects network activity related to Dahua P2P relay services (easy4ipcloud.com) on port 8800. The rules monitor for device lookup queries (/online/p2psrv/), probe requests (/probe/device/), and the presence of WSSE authentication headers, which may indicate interaction with or exploitation attempts by tools targeting P2P-enabled surveillance hardware.
Detects high-frequency connection attempts to TCP port 445 within the internal network or across RFC1918 subnets, indicating potential reconnaissance activity such as SMB share scanning commonly associated with lateral movement or network mapping.
Detects high-frequency connection attempts to PPTP (1723) and L2TP (1701) VPN ports from an external source, indicative of automated scanning or vulnerability discovery activity.
This rule detects high-frequency TCP SYN connection attempts originating from external networks targeting common administrative or tunneling ports (1723/PPTP, 1701/L2TP, 22/SSH) on internal systems. The detection uses a threshold of 100 connection attempts within 120 seconds, which is characteristic of automated reconnaissance and network scanning behavior.
Detects repeated suspicious network requests, including non-standard HTTP methods and URI structures, as well as TLS SNI anomalies, targeting the internal sales portal 'agent.3bb.co.th'. The rule triggers when a threshold of 20 requests within a 60-second window is reached from a single source, indicating likely automated reconnaissance or vulnerability scanning activity.
Detects unauthorized exploitation attempts against the LiteLLM Model Context Protocol (MCP) endpoint. The rule monitors for a specific malformed Authorization header pattern (short, non-standard token) associated with CVE-2026-59822, indicating potential vulnerability scanning or exploitation of the service.
Detects incoming HTTP GET requests targeting Vite development server environments that utilize suspicious query parameters typically associated with vulnerability exploitation (e.g., directory traversal or sensitive file access). The rule specifically flags requests where the User-Agent string contains bot keywords but excludes verified IP ranges, suggesting an attempt to bypass security filters by spoofing crawler identities.
Detects incoming HTTP GET requests targeting Vite development server environments that utilize suspicious query parameters typically associated with vulnerability exploitation (e.g., directory traversal or sensitive file access). The rule specifically flags requests where the User-Agent string contains bot keywords but excludes verified IP ranges, suggesting an attempt to bypass security filters by spoofing crawler identities.
Detects high-volume bursts of HTTP GET requests against specific paths associated with a Vite development server (/@vite/client, /@fs/, /src/) on port 5173. This pattern is indicative of automated reconnaissance or vulnerability scanning targeting an exposed development environment.
Detects outbound network traffic from internal devices interacting with Dahua Easy4IP cloud relay services, specifically identifying device resolution requests, probe actions, and the submission of WSSE authentication headers (UsernameToken and PasswordDigest) to the cloud relay host.
Detects high-frequency connection attempts to PPTP (1723) and L2TP (1701) VPN ports from an external source, indicative of automated scanning or vulnerability discovery activity.
Detects high-frequency connection attempts to PPTP (1723) and L2TP (1701) VPN ports from an external source, indicative of automated scanning or vulnerability discovery activity.
This rule detects high-frequency TCP SYN connection attempts originating from external networks targeting common administrative or tunneling ports (1723/PPTP, 1701/L2TP, 22/SSH) on internal systems. The detection uses a threshold of 100 connection attempts within 120 seconds, which is characteristic of automated reconnaissance and network scanning behavior.
Detects attempts to bypass AWS IMDSv2 security protections via the LiteLLM /config/pass_through_endpoint, where attackers inject the 'x-pass-X-aws-ec2-metadata-token' header to potentially strip authentication requirements.
Detects incoming HTTP GET requests targeting Vite development server environments that utilize suspicious query parameters typically associated with vulnerability exploitation (e.g., directory traversal or sensitive file access). The rule specifically flags requests where the User-Agent string contains bot keywords but excludes verified IP ranges, suggesting an attempt to bypass security filters by spoofing crawler identities.
Detects incoming HTTP GET requests targeting Vite development server environments that utilize suspicious query parameters typically associated with vulnerability exploitation (e.g., directory traversal or sensitive file access). The rule specifically flags requests where the User-Agent string contains bot keywords but excludes verified IP ranges, suggesting an attempt to bypass security filters by spoofing crawler identities.
This rule detects attempts to exploit the LiteLLM proxy pass-through endpoint to interact with the cloud Instance Metadata Service (IMDS). Specifically, it identifies configuration attempts to route traffic to the IMDS IP (169.254.169.254) and subsequent requests to retrieve IAM security credentials, which is indicative of a Server-Side Request Forgery (SSRF) attack to steal cloud identity tokens.
Page 3 of 6