Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
178 detections
Filters
Last updated
All Time
Detection languages
178
Contributors
177
1
Categories
177
99
16
6
6
Platforms
174
9
8
5
4
Products / Services
178
10
5
3
3
MITRE Techniques
103
75
8
7
6
IDS Classtypes
1,937
503
461
381
236
178
IDS Protocols
99
55
15
4
2
This rule detects an ICMP ping sweep, which is a common technique used for host discovery within a network. It triggers an alert if more than 20 ICMP echo requests (type 8) are observed from a single source IP within a 10-second window, targeting the home network. This behavior is indicative of an attacker attempting to map out active hosts on the network.
This rule detects a potential network scan activity where a source IP sends multiple NTP (Network Time Protocol) queries to the internal network within a short period. Specifically, it triggers if a single source IP sends 5 or more UDP packets to destination port 123 (NTP) on the home network within a 30-second window. This behavior can indicate an attacker attempting to discover systems or services on the network by querying for system time.
This rule detects attempts to query the remote system time via Server Message Block (SMB) by looking for the 'NetRemoteTOD' string in network traffic destined for port 445. This activity is often associated with discovery tactics, where an attacker tries to gather information about the target system.
FOFA Internet Asset Search Query
Suricata
This rule detects HTTP requests where the host header contains 'fofa.info'. FOFA is an internet asset search engine, similar to Shodan. This detection indicates that a system within the HOME_NET is making queries to FOFA, which could be part of reconnaissance activities to gather information about internet-facing assets.
This rule detects Kerberos Domain Trust Discovery attempts by monitoring for a high volume of Kerberos Ticket Granting Ticket (TGT) requests to port 88 (Kerberos) on the home network. A threshold of 20 requests from a single source IP within 10 seconds triggers the alert, indicating a potential network scan activity aimed at mapping domain trusts.
This rule detects attempts to fingerprint web server software versions by looking for common server headers in HTTP responses. Specifically, it triggers if a client receives an HTTP response containing 'Apache/', 'nginx/', 'IIS/', or 'PHP/' followed by a digit, indicating a version number. The rule is thresholded to trigger only after 10 such events from the same destination within 30 seconds, aiming to reduce alerts from legitimate browsing.
This rule detects potential network scanning activity targeting LDAP services (port 389) for user session information. It specifically looks for LDAP queries containing "(objectClass=user)" and "lastLogon" within the established TCP flow to the server. A threshold of 5 such queries from the same source within 30 seconds triggers the alert, indicating a possible attempt to enumerate active user sessions.
This rule detects attempts to enumerate domain trusts by querying LDAP for objects with the 'objectClass=trustedDomain' attribute. This activity is often performed by attackers during the discovery phase to map out the network topology and identify potential lateral movement paths. The rule specifically looks for TCP traffic to port 389 (LDAP) on the home network, containing the specified LDAP filter, and uses a threshold to prevent excessive alerts from legitimate, but frequent, queries.
This rule detects HTTP requests to the Kubernetes API endpoint '/api/v1/pods' on port 8080. This activity is indicative of an attempt to discover Kubernetes pods and services, which could be part of reconnaissance by an attacker or an authorized user.
This rule detects a TCP SYN packet (initial connection attempt) directed towards port 10443 on the home network. The message indicates this is a probe targeting a Palo Alto Firewall Management Interface. This suggests an attempt to discover or interact with a Palo Alto firewall's management interface, potentially for reconnaissance or exploitation.
Docker Image Enumeration via API
Suricata
This rule detects attempts to enumerate Docker images via the Docker API. Specifically, it looks for HTTP requests to the '/images/json' endpoint on TCP port 2375, which is commonly used for unauthenticated Docker API access. This activity can indicate an adversary performing reconnaissance on a system to understand its Docker environment.
This rule detects attempts to query Docker version and virtual machine information via the Docker API. It specifically looks for HTTP requests to port 2375 (commonly used for Docker API) with a URI containing "/version". This activity could indicate reconnaissance by an attacker trying to gather information about the Docker environment.
This rule detects attempts to remotely enumerate Windows Event Logs over SMB. It specifically looks for TCP traffic on port 445 (SMB) where the content includes both "eventlog" and "EvtQuery" (case-insensitive), indicating a query for event log information.
This rule detects a high rate of HTTP GET requests that are likely resulting in 404 (Not Found) errors, indicative of a directory brute-force attack. The rule triggers if a single source IP makes 50 or more HTTP GET requests within a 10-second window, suggesting an automated attempt to discover hidden directories or files on a web server.
This rule detects HTTP requests where the User-Agent header contains the string "ffuf" (case-insensitive). FFUF (Ffuf is a Fast Web Fuzzer) is a common tool used for web enumeration, including directory and file brute-forcing. Detection of this User-Agent indicates a potential reconnaissance activity or an attempt to discover hidden web resources.
This rule detects HTTP requests originating from the Nessus vulnerability scanner. It specifically looks for the string "Nessus" (case-insensitive) within the HTTP User-Agent header of outgoing HTTP traffic from the protected network.
This rule detects Simple Network Management Protocol (SNMP) Bulk Get requests targeting port 161 on the home network, specifically looking for a content byte pattern indicative of MIB (Management Information Base) configuration data. It uses a threshold of 20 such requests within 30 seconds from the same source IP to trigger an alert, suggesting a network scan or reconnaissance activity.
This rule detects a Simple Network Management Protocol (SNMP) Management Information Base (MIB) walk dump, which is often used for configuration collection. It specifically looks for UDP traffic destined for port 161 (the standard SNMP port) within the home network, containing the byte sequence "30 82" at a depth of 2 bytes. A threshold of 50 such events from the same source within 30 seconds triggers the alert, indicating a potential network scan or reconnaissance activity.
This rule detects attempts to access network device configurations via SNMP (UDP port 161) by looking for the string "public" in the UDP payload. A threshold of 10 occurrences within 30 seconds from the same source IP is set to trigger an alert, indicating a potential network scan or reconnaissance activity targeting SNMP with a common community string.
This rule detects attempts to enumerate logged-in users on a remote system via SMB, specifically looking for the 'NetWkstaUserEnum' string in network traffic. This activity is often associated with discovery tactics used by attackers to gain information about a target environment.
This rule detects attempts to enumerate system services on a remote host via the Server Message Block (SMB) protocol. Specifically, it looks for network traffic on TCP port 445 (SMB) containing the strings "svcctl" and "EnumServicesStatus" (case-insensitive), which are indicative of a remote service control request to list services.
Page 1 of 9