Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
27 detections
Filters
Last updated
All Time
Detection languages
27
Contributors
14
6
3
2
1
Categories
21
13
9
7
4
Platforms
26
3
1
Products / Services
26
17
12
1
MITRE Techniques
15
15
14
6
5
IDS Classtypes
8
6
5
4
2
IDS Protocols
2,431
868
408
324
97
27
This rule detects an ICMP flood Denial of Service (DoS) attack. It triggers an alert when more than 200 ICMP echo request (type 8) packets are observed targeting a single destination within a 5-second window. This high volume of ICMP traffic is indicative of an attempt to overwhelm a target system or network, leading to service disruption.
This rule detects an ICMP ping sweep for host discovery, a technique used by attackers to identify active hosts on a network. It triggers when more than 20 ICMP echo requests (type 8) are sent from a single source within a 10-second window to the home network.
This rule detects network topology discovery attempts via ICMP host sweeps. It triggers an alert when a source IP sends 50 or more ICMP echo requests (type 8) within a 10-second window to the local network. This behavior is indicative of an attacker trying to identify active hosts on a network.
This rule detects ICMP (Internet Control Message Protocol) packets that are characteristic of a traceroute operation, specifically those with a Time-To-Live (TTL) value less than 5. Traceroute is a network diagnostic tool used to display the route and measure transit delays of packets across an Internet Protocol (IP) network. Adversaries can use this technique for network topology discovery to map out the network infrastructure.
DOS Sustained ICMP Flood Attempt
Suricata
This rule detects a sustained ICMP flood attempt, which is a type of Denial of Service (DoS) attack. It triggers an alert if more than 100 ICMP packets (type 8, echo request) are observed from an external network to the home network within a 10-second window, tracked per source IP. This indicates an adversary is attempting to overwhelm the target system or network with ICMP traffic.
This rule detects a high rate of ICMP echo requests from a single source to a server within the home network, indicating a potential Denial of Service (DoS) attack. It triggers an alert if more than 50 ICMP echo requests are observed from the same source within a 1-second interval.
Page 2 of 2