Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
22 detections
Filters
Last updated
All Time
Detection languages
22
Contributors
21
1
Categories
17
14
10
6
5
Platforms
21
Products / Services
21
MITRE Techniques
22
6
3
3
3
IDS Classtypes
1,937
503
461
381
236
22
IDS Protocols
7
5
5
2
2
Possible DDoS botnet outbound flood burst from infected host
This rule detects a potential HTTP POST flood Distributed Denial of Service (DDoS) attack. It triggers an alert when a single source IP address sends 100 or more HTTP POST requests to the server within a 10-second window. This behavior is indicative of an attempt to overwhelm the server with requests, consuming resources and potentially leading to service disruption.
This rule detects NTP Reflection Amplification DDoS attacks by looking for specific content in UDP packets destined for the home network on port 123 (NTP). The rule triggers if 50 such packets are observed from the same destination within 5 seconds, indicating a high volume of NTP traffic potentially used for amplification.
This rule detects a potential DNS Reflection Amplification Distributed Denial of Service (DDoS) attack. It triggers an alert when UDP traffic targeting port 53 (DNS) on the home network has a data size greater than 512 bytes and occurs at a rate of 100 or more packets within a 5-second window from the same destination.
This rule detects a direct ICMP Flood Denial of Service (DoS) attack. It triggers when more than 500 ICMP echo request (type 8) packets are sent to a single destination within a 5-second interval. This high volume of ICMP traffic is characteristic of an attempt to overwhelm a target system or network with ping requests, leading to service disruption.
This rule detects an outbound email bombing campaign by monitoring TCP connections to port 25 (SMTP). It triggers an alert if a single source IP address initiates 200 or more established connections to port 25 within a 60-second window. This high volume of outbound email connections from a single source is indicative of an attempt to overwhelm an email server or recipient with a large number of emails, often associated with denial-of-service attacks.
Direct TCP SYN Flood DoS Attack
Suricata
This rule detects a direct TCP SYN flood Denial of Service (DoS) attack. It triggers when a destination IP address receives 1000 or more TCP SYN packets within a 5-second window. The 'flags:S' indicates that only packets with the SYN flag set are counted. This type of attack aims to exhaust the target's resources by initiating many half-open connections.
This rule detects a direct User Datagram Protocol (UDP) flood Denial of Service (DoS) attack. It triggers an alert if more than 1000 UDP packets are observed targeting a single destination within a 5-second window. This high volume of UDP traffic is indicative of an attempt to overwhelm a target system or network resource, making it unavailable to legitimate users.
This rule detects a high volume of inbound emails to port 25 (SMTP), indicating a potential email bombing attack. It triggers an alert if more than 100 emails are received from a single source IP address within a 60-second window.
This rule detects a TCP connection flood, specifically looking for a high rate of TCP SYN packets (indicated by the 'flags:S' keyword) directed towards a single destination IP address within a short timeframe. A threshold of 500 SYN packets within 5 seconds to the same destination triggers the alert. This behavior is characteristic of a Denial of Service (DoS) attack, aiming to exhaust the target's resources by overwhelming it with connection requests.
This rule detects NTP amplification DDoS attacks by looking for UDP traffic on port 123 (NTP) with a specific content signature ('|17 00 03 2a|') and a high threshold of 50 packets within 5 seconds from the same destination. This pattern is indicative of an NTP monlist request, which can be abused for amplification attacks.
This rule detects an ICMP flood Denial of Service (DoS) attack. It triggers an alert when more than 200 ICMP echo request (type 8) packets are observed targeting a single destination within a 5-second window. This high volume of ICMP traffic is indicative of an attempt to overwhelm a target system or network, leading to service disruption.
This rule detects an HTTP flood application-layer Distributed Denial of Service (DDoS) attack. It triggers when a single source IP address sends 200 or more HTTP GET requests to a server within a 10-second window. This behavior is indicative of an attempt to overwhelm the application or server with a high volume of legitimate-looking HTTP requests.
This rule detects a DNS Amplification Distributed Denial of Service (DDoS) attack. It triggers an alert when UDP traffic destined for port 53 (DNS) on the home network has a data size greater than 512 bytes and exceeds a threshold of 100 packets within 5 seconds, tracked by destination IP address. This pattern is indicative of a DNS amplification attack where small queries result in large responses, overwhelming the target.
This rule detects a Slowloris Slow HTTP DoS attack. It triggers when a single source IP sends 100 HTTP GET requests within a 300-second window to the internal network. Slowloris attacks work by holding open many HTTP connections to a web server, eventually exhausting the server's connection pool and making it unavailable to legitimate users.
This rule detects an application layer HTTP POST flood, which is a type of Denial of Service (DoS) attack. It triggers when a single destination receives 200 or more HTTP POST requests within a 10-second window. This high volume of POST requests is indicative of an attempt to exhaust server resources or bandwidth.
This rule detects a denial-of-service attack characterized by a high volume of HTTP GET requests targeting a server within a short timeframe. Specifically, it triggers if a single destination IP address receives 500 or more HTTP GET requests within a 10-second window, indicating a potential HTTP request flood aimed at exhausting service resources.
This rule detects a CHARGEN Reflection Amplification Attack. It specifically looks for UDP traffic on port 19 (the CHARGEN service port) directed towards the home network. A threshold of 50 packets within 5 seconds, tracked by destination, is used to identify potential amplification attempts, indicating a denial-of-service attack.
This rule detects an 'Email Subscription Bomb' attack, where an attacker automates sign-ups to various services using a victim's email address. The goal is to flood the victim's inbox with confirmation emails, potentially causing a denial of service or distracting them from other malicious activities. The rule specifically looks for SMTP traffic to port 25 containing the phrase 'confirm your subscription' (case-insensitive) and triggers an alert if this content is seen 50 times within 60 seconds from the same destination IP address.
This rule detects a potential SSL/TLS Handshake Exhaustion Attack. It triggers when a high volume of TCP SYN packets (flags:S) are observed targeting port 443 (HTTPS) on the home network within a short timeframe. Specifically, it looks for more than 200 SYN packets to the same destination within a 5-second window, indicating an attempt to overwhelm the server with handshake requests, leading to a denial of service.
This rule detects a UDP flood Denial of Service (DoS) attack targeting the home network. It triggers an alert if more than 1000 UDP packets are observed from any source to any destination within the home network within a 5-second interval, tracked per destination.
Page 1 of 2