Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
97 detections
Filters
Last updated
All Time
Detection languages
97
Contributors
58
18
10
5
5
Categories
45
42
30
30
16
Platforms
93
14
3
2
2
Products / Services
93
34
9
3
3
MITRE Techniques
15
15
14
13
13
CVEs
6
6
4
2
2
IDS Classtypes
25
15
12
10
8
IDS Protocols
2,431
868
408
324
97
This rule detects a potential DNS Reflection Amplification Distributed Denial of Service (DDoS) attack. It triggers an alert when UDP traffic targeting port 53 (DNS) on the home network has a data size greater than 512 bytes and occurs at a rate of 100 or more packets within a 5-second window from the same destination.
This rule detects attempts to push malicious firmware to a device via TFTP (Trivial File Transfer Protocol). It specifically looks for UDP traffic on port 69 (TFTP) where the packet content starts with "|00 02|" (indicating a TFTP write request) and the data size is greater than 10000 bytes, suggesting a firmware image transfer.
This rule detects potential data exfiltration over Bluetooth Network Encapsulation Protocol (BNEP) by monitoring UDP traffic on port 3232. It triggers an alert if more than 5 such packets are observed from a single source within a 60-second window, indicating a possible attempt to transfer data out of the network via Bluetooth.
This rule detects a direct User Datagram Protocol (UDP) flood Denial of Service (DoS) attack. It triggers an alert if more than 1000 UDP packets are observed targeting a single destination within a 5-second window. This high volume of UDP traffic is indicative of an attempt to overwhelm a target system or network resource, making it unavailable to legitimate users.
This rule detects DNS responses with a very low Time-To-Live (TTL) value, which is a characteristic often associated with fast flux techniques used by malware to rapidly change IP addresses. Specifically, it looks for UDP traffic on port 53 (DNS) where the DNS response contains a specific content pattern indicating a low TTL.
This rule detects potential Kerberos 'Pass the Ticket' (PtT) attacks, specifically focusing on the reuse of Kerberos Ticket Granting Tickets (TGTs). It triggers when UDP traffic to port 88 (Kerberos) on the home network contains the byte sequence '|6b|' at the beginning of the payload, and this activity occurs 10 times within 5 seconds from the same source IP. The '6b' byte often indicates a Kerberos AP-REQ message, which is used to request access to a service. Repeated AP-REQ messages from the same source could indicate TGT reuse.
This rule detects a high volume of UDP traffic on port 4500 to the home network, which is commonly used for IPSec NAT Traversal. The rule is specifically looking for an 'evasion' scenario, implying that this traffic pattern might be indicative of an attempt to bypass security controls or blend in with legitimate IPSec traffic. The threshold of 10 connections from the same source within 30 seconds suggests an attempt to identify sustained or repeated activity rather than a single, isolated event.
This rule detects a Silver Ticket attack, specifically looking for forged Kerberos service tickets. It inspects UDP traffic on port 88 (Kerberos) for specific byte sequences indicative of a forged ticket. The content '|6b|' at depth 1 and '|a0 03 02 01 05|' are specific patterns associated with the structure of a Kerberos ticket, which when combined, suggest a malicious attempt to authenticate to a service without proper credentials.
This rule detects a rogue DHCP server offer on the network. It specifically looks for UDP traffic on port 67 (DHCP server port) to the home network, containing the DHCP message type '02' (DHCP Offer) at the beginning of the payload. A threshold is set to trigger an alert if 3 such offers are detected from the same source within 10 seconds, indicating a potentially malicious or misconfigured DHCP server attempting to assign IP addresses.
This rule detects when a network device configuration is transferred via TFTP. It specifically looks for UDP traffic on port 69 (TFTP's default port) and checks for the byte sequence "|00 02|" at the beginning of the payload, which corresponds to a TFTP read request (opcode 2). This activity is often associated with attackers collecting configuration files from network devices.
This rule detects Simple Network Management Protocol (SNMP) Bulk Get requests targeting port 161 on the home network, specifically looking for a content byte pattern indicative of MIB (Management Information Base) configuration data. It uses a threshold of 20 such requests within 30 seconds from the same source IP to trigger an alert, suggesting a network scan or reconnaissance activity.
This rule detects a Simple Network Management Protocol (SNMP) Management Information Base (MIB) walk dump, which is often used for configuration collection. It specifically looks for UDP traffic destined for port 161 (the standard SNMP port) within the home network, containing the byte sequence "30 82" at a depth of 2 bytes. A threshold of 50 such events from the same source within 30 seconds triggers the alert, indicating a potential network scan or reconnaissance activity.
This rule detects attempts to access network device configurations via SNMP (UDP port 161) by looking for the string "public" in the UDP payload. A threshold of 10 occurrences within 30 seconds from the same source IP is set to trigger an alert, indicating a potential network scan or reconnaissance activity targeting SNMP with a common community string.
This rule detects potential rogue DHCP servers on a wireless segment by looking for UDP traffic on port 67 (DHCP server port) with a specific DHCP message type (likely a DHCP offer or acknowledgement, indicated by '|02|' at offset 0). It uses a thresholding mechanism to trigger an alert if 3 such packets are observed from the same source within 10 seconds, which helps to reduce false positives from single, isolated packets.
This rule detects potential VPN gateway fingerprinting attempts via the Internet Key Exchange (IKE) protocol. It triggers an alert when a source IP sends 5 or more UDP packets to port 500 (the standard IKE port) on the home network within a 30-second window. This behavior can indicate an attacker attempting to identify active VPN services or their configurations.
This rule detects NTP amplification DDoS attacks by looking for UDP traffic on port 123 (NTP) with a specific content signature ('|17 00 03 2a|') and a high threshold of 50 packets within 5 seconds from the same destination. This pattern is indicative of an NTP monlist request, which can be abused for amplification attacks.
This rule detects Kerberoasting activity, specifically looking for multiple Kerberos Ticket Granting Service (TGS) requests over UDP port 88 within a short timeframe from the same source IP. Kerberoasting is a post-exploitation technique used by attackers to obtain service principal name (SPN) hashes, which can then be cracked offline to retrieve the associated plaintext passwords. The rule uses a threshold of 20 TGS requests within 10 seconds from a single source to identify this suspicious behavior.
This rule detects a high rate of DNS queries from a single source IP address to the local network (HOME_NET) on UDP port 53. Specifically, it triggers an alert if more than 100 DNS queries are observed from the same source within a 10-second window. This behavior is indicative of network reconnaissance, where an attacker might be rapidly querying DNS to map out internal network resources or identify potential targets.
This rule detects a TFTP (Trivial File Transfer Protocol) boot file request. Specifically, it looks for UDP traffic destined for port 69 (the standard TFTP port) on the home network, containing the byte sequence "|00 01|" at a depth of 2 bytes. This pattern is characteristic of a TFTP read request (opcode 1). The rule's message suggests this could indicate a possible bootkit delivery attempt, as TFTP is often used in network booting scenarios.
This rule detects when a TFTP (Trivial File Transfer Protocol) boot image is potentially pushed to a network device. It specifically looks for UDP traffic on port 69 (TFTP default port) directed to the home network, containing the byte sequence "|00 02|" (which often indicates a TFTP write request or a specific TFTP opcode) and having a data size greater than 10000 bytes, suggesting a large file transfer like a boot image.
This rule detects multiple TFTP (Trivial File Transfer Protocol) transfers to port 69 on the home network within a short timeframe. Specifically, it triggers an alert if three or more TFTP transfers from the same source IP address occur within a 30-second window. This activity can be indicative of a Pre-Boot Execution Environment (PXE) boot process, which often uses TFTP to transfer boot files, or potentially malicious activity involving file transfers via TFTP.
Page 3 of 5