Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
118 detections
Filters
Last updated
All Time
Detection languages
117
1
Contributors
52
30
22
5
3
Categories
98
67
61
26
22
Platforms
102
27
19
6
6
Products / Services
113
102
14
3
2
MITRE Techniques
67
39
37
29
28
CVEs
4
4
3
2
1
IDS Classtypes
1,937
503
461
381
236
118
IDS Protocols
64
44
4
2
2
Detects high-rate scanning and automated service probing patterns consistent with network reconnaissance. This includes tracking TCP SYN floods to external segments, excessive HTTP/login requests, and automated fingerprinting probes (e.g., favicon or admin panel enumeration). The rule accounts for common uptime monitoring services to minimize false positives.
This rule detects inbound HTTP requests targeting a Vite development server that attempt to access the '.env' configuration file via the '//@fs/' path, which is a known technique for sensitive file exposure in misconfigured Vite environments.
Detects high-volume bursts of HTTP GET requests against specific paths associated with a Vite development server (/@vite/client, /@fs/, /src/) on port 5173. This pattern is indicative of automated reconnaissance or vulnerability scanning targeting an exposed development environment.
Detects high-volume bursts of HTTP GET requests against specific paths associated with a Vite development server (/@vite/client, /@fs/, /src/) on port 5173. This pattern is indicative of automated reconnaissance or vulnerability scanning targeting an exposed development environment.
Detects high-frequency TCP/445 connection attempts (a 'connect sweep') characteristic of automated SMB share enumeration, which is commonly used for lateral movement reconnaissance. The rule triggers when a threshold of 40 connection requests occurs from a single source within a 30-second window, specifically targeting SMB-related lateral movement behaviors.
Detects high-frequency SYN scanning activity targeting TCP port 37777 (commonly associated with Dahua devices) from an external source. This behavior is indicative of automated reconnaissance or mass-scanning campaigns, such as Operation CameraSwarm, attempting to identify exposed or potentially vulnerable IoT/surveillance hardware.
This rule detects attempts to exploit the LiteLLM proxy pass-through endpoint to interact with the cloud Instance Metadata Service (IMDS). Specifically, it identifies configuration attempts to route traffic to the IMDS IP (169.254.169.254) and subsequent requests to retrieve IAM security credentials, which is indicative of a Server-Side Request Forgery (SSRF) attack to steal cloud identity tokens.
Detects high-frequency TCP/445 connection attempts (a 'connect sweep') characteristic of automated SMB share enumeration, which is commonly used for lateral movement reconnaissance. The rule triggers when a threshold of 40 connection requests occurs from a single source within a 30-second window, specifically targeting SMB-related lateral movement behaviors.
Detects high-rate scanning and automated service probing patterns consistent with network reconnaissance. This includes tracking TCP SYN floods to external segments, excessive HTTP/login requests, and automated fingerprinting probes (e.g., favicon or admin panel enumeration). The rule accounts for common uptime monitoring services to minimize false positives.
Detects high-rate scanning and automated service probing patterns consistent with network reconnaissance. This includes tracking TCP SYN floods to external segments, excessive HTTP/login requests, and automated fingerprinting probes (e.g., favicon or admin panel enumeration). The rule accounts for common uptime monitoring services to minimize false positives.
This rule detects rapid SYN packet patterns from external sources targeting the Dahua proprietary port 37777, characteristic of network scanning tools like Masscan attempting to discover or identify vulnerable Dahua devices.
This rule detects rapid, repetitive connection attempts (TCP SYN) from a source within the internal network to a set of high-value targets (SSH, HTTP, SMB, RDP ports) within the same internal network. Such patterns are indicative of lateral movement or internal network reconnaissance, often performed by adversaries pivoting through a compromised host to discover services on other internal systems.
This rule detects a multi-stage reconnaissance behavior where an internal host first establishes a TLS connection to speedtest.net, followed immediately by high-volume TCP SYN packet activity (100+ events in 10 seconds), characteristic of network scanning tools like Masscan.
Detects high-frequency TCP SYN connection attempts originating from an internal device, which is indicative of a port scanning behavior typically used for network service discovery.
Detects anomalous, high-frequency inbound TCP connection attempts to port 102 (S7comm), which is used by Siemens S7 PLCs. This behavior is indicative of automated network scanning or reconnaissance targeting industrial control system (ICS) infrastructure.
Detects incoming S7comm/ISO-TSAP connection attempts directed at Siemens Programmable Logic Controllers (PLCs) originating from an external network. This behavior is indicative of unauthorized access or reconnaissance attempts against Industrial Control System (ICS) assets.
Detects repeated attempts to establish S7comm connections to a Programmable Logic Controller (PLC) on port 102. This behavior is indicative of network reconnaissance or scanning targeting Industrial Control Systems (ICS).
Detects external scanning and connection attempts against internet-exposed macOS Screen Sharing (port 5900), including mass scanning and coordinated multi-source probing, with an allowlist for known internal scanners.
Detects completed RFB/VNC protocol handshakes to internal macOS Screen Sharing hosts (TCP/5900) from external networks, thresholded to separate reconnaissance/scanning from single stray connections. Early-warning exposure signal for CVE-2026-65400 targeting.
Detects outbound FOFA asset-search traffic containing an exact title="Langflow" query directed at the FOFA API host (fofa.info), indicating reconnaissance for Langflow deployments.
Detects high-frequency HTTP GET request patterns indicative of bulk vulnerability scanning using the Nuclei scanner against public-facing web services. The rule triggers when a source IP initiates 250 or more requests within a 300-second window, excluding pre-authorized scanner source IP addresses.
Page 5 of 6