Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
22 detections
Filters
Last updated
All Time
Detection languages
22
Contributors
21
1
Categories
17
14
10
6
5
Platforms
21
Products / Services
21
MITRE Techniques
22
6
3
3
3
IDS Classtypes
1,937
503
461
381
236
22
IDS Protocols
7
5
5
2
2
This rule detects a TCP SYN Flood Denial of Service (DoS) attack. It triggers when a high volume of TCP SYN packets (1000 packets within 5 seconds) are observed targeting a single destination IP address within the HOME_NET, indicating an attempt to overwhelm the target's network resources.
Page 2 of 2