Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
97 detections
Filters
Last updated
All Time
Detection languages
97
Contributors
58
18
10
5
5
Categories
45
42
30
30
16
Platforms
93
14
3
2
2
Products / Services
93
34
9
3
3
MITRE Techniques
15
15
14
13
13
CVEs
6
6
4
2
2
IDS Classtypes
25
15
12
10
8
IDS Protocols
2,431
868
408
324
97
This rule detects suspicious UDP traffic directed at port 8800 targeting the Dahua P2P cloud relay interface. It specifically monitors for enumeration attempts against device serial numbers, which may be a precursor to unauthorized access or reconnaissance against vulnerable Dahua devices.
Detects network activity related to the exploitation of Dahua P2P relay services via easy4ipcloud.com. The rule monitors for unauthorized device probing, serial number enumeration, and illicit relay authentication attempts (e.g., using DHP2P protocols and X-WSSE authentication), which are indicative of attackers attempting to abuse IoT device remote access functionality (CVE-2025-31702).
Detects network activity related to Dahua P2P relay services (easy4ipcloud.com) on port 8800. The rules monitor for device lookup queries (/online/p2psrv/), probe requests (/probe/device/), and the presence of WSSE authentication headers, which may indicate interaction with or exploitation attempts by tools targeting P2P-enabled surveillance hardware.
Detects anomalous STUN bind-requests containing 'PTCP' headers directed at the loopback interface, commonly associated with the exploitation of Dahua P2P relay services for traffic redirection or unauthorized access.
Detects potential unauthenticated Remote Code Execution (RCE) exploitation attempts targeting the IKEv2/ISAKMP VPN service on WatchGuard Firebox devices (CVE-2025-14733). The rule monitors UDP traffic on standard IKE ports 500 and 4500, looking for specific payload patterns and elevated data sizes consistent with exploitation attempts, coupled with a threshold to reduce noise.
Detects potential unauthenticated Remote Code Execution (RCE) exploitation attempts targeting the IKEv2/ISAKMP VPN service on WatchGuard Firebox devices (CVE-2025-14733). The rule monitors UDP traffic on standard IKE ports 500 and 4500, looking for specific payload patterns and elevated data sizes consistent with exploitation attempts, coupled with a threshold to reduce noise.
Detects potential unauthenticated Remote Code Execution (RCE) exploitation attempts targeting the IKEv2/ISAKMP VPN service on WatchGuard Firebox devices (CVE-2025-14733). The rule monitors UDP traffic on standard IKE ports 500 and 4500, looking for specific payload patterns and elevated data sizes consistent with exploitation attempts, coupled with a threshold to reduce noise.
Detects potential unauthenticated Remote Code Execution (RCE) exploitation attempts targeting the IKEv2/ISAKMP VPN service on WatchGuard Firebox devices (CVE-2025-14733). The rule monitors UDP traffic on standard IKE ports 500 and 4500, looking for specific payload patterns and elevated data sizes consistent with exploitation attempts, coupled with a threshold to reduce noise.
Detects network-based exploitation attempts against Dahua Easy4IP P2P relay infrastructure, including reconnaissance probes, unauthorized relay usage, and credential theft attempts via WSSE authentication.
This rule detects potentially malicious network activity involving Dahua PTCP protocol packets that specifically request a loopback bind (127.0.0.1) using an inverted-STUN style mechanism. This behavior is indicative of an adversary attempting to bypass network segmentation or perform local service proxying/tunneling to maintain command and control or enable unauthorized access to internal services on the target device.
Suricata signature detecting a Zoom annotation CAnnoFormatBlock/CAnnoTextFrame/CAnnoTextRange PDU where a count field (count1-4) precisely exceeds 64, overflowing the 128-byte destination buffer — the wire-level trigger for the ZOOMSDAY buffer overflow, stack overflow, and heap-disclosure primitives (CVE-2026-53413).
Suricata signature for a Zoom annotation PDU carrying opcode 0x10001 (AddObj) delivered on the downstream acknowledgement channel (which should only carry 0x10002/AddObjAck), indicating sender-role/opcode confusion that lets any participant forge presenter-privileged annotation objects (ZOOMSDAY, CVE-2026-53413/53414/53415).
Detects the UNC5142 DeviceManager RAT's DNS-based C2 channel: raw malformed/non-resolver UDP/53 packets and Base64-chunked o-/e-/r- prefixed query names to 91.92.240.100, plus microsoft.com-suffixed decoy queries.
Detects CVE-2026-33824 IKE VPN endpoint exploitation traffic (UDP 500/4500) correlated within a 5-minute window with a subsequent outbound reverse-shell callback from the same host.
This rule detects UDP traffic patterns characteristic of the msaRAT C2 handshake. It specifically identifies initial WebRTC DataChannel connection frames containing the 0xFE marker combined with ChaCha-Poly1305 encryption indicators within the expected packet size range.
Detects anomalous, oversized IKEv1 Phase 1 packets targeting Check Point VPN devices, indicative of an exploitation attempt for CVE-2026-50751.
Detects anomalous, oversized IKEv1 Phase 1 packets targeting Check Point VPN devices, indicative of an exploitation attempt for CVE-2026-50751.
This rule detects NBT-NS (NetBIOS Name Service) poisoning responses. NBT-NS poisoning is a technique used by attackers to intercept network traffic by responding to NetBIOS name queries with their own IP address, effectively redirecting traffic. The rule specifically looks for UDP traffic on port 137 (NetBIOS Name Service) destined for the home network, containing the byte sequence '|85 00|' at a depth of 4 bytes, which is indicative of a NetBIOS Name Service response. A threshold of 5 such responses within 10 seconds from the same source IP triggers the alert, aiming to reduce false positives from legitimate, but infrequent, NBT-NS responses.
This rule detects a Link-Local Multicast Name Resolution (LLMNR) poisoning response from a rogue host. It specifically looks for UDP traffic on port 5355 (LLMNR) where the content contains the byte sequence '|80 00|' at a depth of 4 bytes. A threshold is applied to trigger an alert if 5 such responses are observed from the same source IP within 10 seconds, indicating potential malicious activity like credential harvesting.
This rule detects a potential network scan activity where a source IP sends multiple NTP (Network Time Protocol) queries to the internal network within a short period. Specifically, it triggers if a single source IP sends 5 or more UDP packets to destination port 123 (NTP) on the home network within a 30-second window. This behavior can indicate an attacker attempting to discover systems or services on the network by querying for system time.
This rule detects NTP Reflection Amplification DDoS attacks by looking for specific content in UDP packets destined for the home network on port 123 (NTP). The rule triggers if 50 such packets are observed from the same destination within 5 seconds, indicating a high volume of NTP traffic potentially used for amplification.
Page 2 of 5