Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
97 detections
Filters
Last updated
All Time
Detection languages
97
Contributors
58
18
10
5
5
Categories
45
42
30
30
16
Platforms
93
14
3
2
2
Products / Services
93
34
9
3
3
MITRE Techniques
15
15
14
13
13
CVEs
6
6
4
2
2
IDS Classtypes
25
15
12
10
8
IDS Protocols
2,431
868
408
324
97
Detects an attempt to exploit CVE-2026-88772 by identifying an oversized DTLS handshake record on a NetScaler Gateway. The rule looks for UDP traffic on port 443 where the initial handshake record exceeds the expected size threshold, indicative of a potential buffer overflow attempt.
This rule detects potentially malformed or truncated DTLS records on NetScaler appliances, specifically on port 443. The rule looks for packets with a specific record length configuration that may indicate a buffer overflow or other exploitation attempt targeting CVE-2026-88772. The detection logic relies on analyzing the DTLS handshake sequence and packet sizing, and the rule authors recommend correlating these events with SSL_HANDSHAKE_FAILURE (DTLSv1.0, Handshake failure-Internal Error) and appliance crash log entries to confirm potential exploitation.
Detects specific markers in UDP traffic on ports 3478, 5349, and 443 that are associated with the DragonForce malware's TRN1 C2 beaconing protocol. The rules identify session initiation, task polling, task acknowledgment, and result uploading behaviors.
This rule detects potential exploitation attempts targeting the CAPWAP (Control and Provisioning of Wireless Access Points) protocol in FortiOS or FortiSwitchManager. The rule identifies suspicious UDP traffic on port 5246 containing an oversized payload (greater than 1400 bytes), which is characteristic of the exploitation pattern for CVE-2025-25249.
This rule detects an exploitation attempt targeting a memory overflow vulnerability in Citrix NetScaler Gateway, specifically identifying oversized DTLS handshake length fields in UDP traffic. The rule triggers when a DTLS packet exceeds the specified size threshold, which is indicative of a buffer overflow attack intended to cause a service crash (Denial of Service).
This rule detects an exploitation attempt targeting a memory overflow vulnerability in Citrix NetScaler Gateway, specifically identifying oversized DTLS handshake length fields in UDP traffic. The rule triggers when a DTLS packet exceeds the specified size threshold, which is indicative of a buffer overflow attack intended to cause a service crash (Denial of Service).
This rule detects an exploitation attempt targeting a memory overflow vulnerability in Citrix NetScaler Gateway, specifically identifying oversized DTLS handshake length fields in UDP traffic. The rule triggers when a DTLS packet exceeds the specified size threshold, which is indicative of a buffer overflow attack intended to cause a service crash (Denial of Service).
Detects specific markers in UDP traffic on ports 3478, 5349, and 443 that are associated with the DragonForce malware's TRN1 C2 beaconing protocol. The rules identify session initiation, task polling, task acknowledgment, and result uploading behaviors.
Detects specific markers in UDP traffic on ports 3478, 5349, and 443 that are associated with the DragonForce malware's TRN1 C2 beaconing protocol. The rules identify session initiation, task polling, task acknowledgment, and result uploading behaviors.
This rule detects an exploitation attempt targeting a memory overflow vulnerability in Citrix NetScaler Gateway, specifically identifying oversized DTLS handshake length fields in UDP traffic. The rule triggers when a DTLS packet exceeds the specified size threshold, which is indicative of a buffer overflow attack intended to cause a service crash (Denial of Service).
Detects specific markers in UDP traffic on ports 3478, 5349, and 443 that are associated with the DragonForce malware's TRN1 C2 beaconing protocol. The rules identify session initiation, task polling, task acknowledgment, and result uploading behaviors.
Detects anomalous, oversized fragmented UDP traffic (exceeding 1400 bytes) targeting or originating from the MikroTik btest service port (2000). This behavior is indicative of attempts to trigger integer underflows, system crashes, or uninitialized memory disclosures within the btest protocol implementation.
Detects network activity related to the exploitation of the CVE-2025-31702 vulnerability in Dahua P2P Relay services. The rules monitor for probe attempts, device parameter fetching (randsalt), serial number enumeration bursts, and successful no-auth channel responses, indicating a bypass of authentication mechanisms on vulnerable Dahua devices.
Detects a burst of Kerberos TGS-REQ (Ticket-Granting Service Request) messages using RC4 encryption (etype 0x17) over UDP or TCP port 88. A high volume of these requests from a single source within a short timeframe is indicative of Kerberoasting, a technique where an attacker requests service tickets to perform offline password cracking of service account credentials.
Detects a sequence of Tox P2P protocol packets consisting of a Cookie Request, Cookie Response, and Crypto Handshake within a single network flow. This pattern is indicative of the Tox P2P protocol, which is sometimes abused by malware (e.g., AvisLoader) for command-and-control (C2) communications to evade traditional network inspection.
Detects a sequence of Tox P2P protocol packets consisting of a Cookie Request, Cookie Response, and Crypto Handshake within a single network flow. This pattern is indicative of the Tox P2P protocol, which is sometimes abused by malware (e.g., AvisLoader) for command-and-control (C2) communications to evade traditional network inspection.
Detects network activity related to the exploitation of the CVE-2025-31702 vulnerability in Dahua P2P Relay services. The rules monitor for probe attempts, device parameter fetching (randsalt), serial number enumeration bursts, and successful no-auth channel responses, indicating a bypass of authentication mechanisms on vulnerable Dahua devices.
Detects network traffic associated with exploitation attempts against Dahua P2P relay services. The rules monitor for specific URI patterns ('/online/p2psrv/' and '/probe/device/') used to probe the device, as well as traffic containing a hardcoded AES-OFB initialization vector, which indicates attempts to exploit CVE-2025-31702.
Detects a sequence of Tox P2P protocol packets consisting of a Cookie Request, Cookie Response, and Crypto Handshake within a single network flow. This pattern is indicative of the Tox P2P protocol, which is sometimes abused by malware (e.g., AvisLoader) for command-and-control (C2) communications to evade traditional network inspection.
Detects a sequence of Tox P2P protocol packets consisting of a Cookie Request, Cookie Response, and Crypto Handshake within a single network flow. This pattern is indicative of the Tox P2P protocol, which is sometimes abused by malware (e.g., AvisLoader) for command-and-control (C2) communications to evade traditional network inspection.
Detects high-frequency, unauthenticated probe requests targeting Dahua P2P relay endpoints (/probe/device/ and /online/p2psrv/). This activity is indicative of automated scanning, enumeration, or potential exploitation attempts related to CVE-2025-31702 against internet-facing or network-connected Dahua hardware.
Page 1 of 5