Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
97 detections
Filters
Last updated
All Time
Detection languages
97
Contributors
58
18
10
5
5
Categories
45
42
30
30
16
Platforms
93
14
3
2
2
Products / Services
93
34
9
3
3
MITRE Techniques
15
15
14
13
13
CVEs
6
6
4
2
2
IDS Classtypes
25
15
12
10
8
IDS Protocols
2,431
868
408
324
97
This rule detects unauthorized DNS server responses originating from external hosts. Specifically, it looks for UDP traffic on port 53 (DNS) with a specific content signature '|84 00|' at an offset of 2 bytes and a depth of 2 bytes, which corresponds to a DNS response header indicating a standard query response. The rule uses a threshold to alert if 10 such responses are observed from the same source within 30 seconds, suggesting a potential unauthorized or malicious DNS activity.
This rule detects network host discovery attempts via UDP sweeps. It triggers an alert when a single source IP sends 30 or more UDP packets within a 10-second window to various destinations on the home network. This behavior is indicative of an attacker attempting to map out active hosts on a network.
SNMP Bulk Walk Enumeration
Suricata
This rule detects SNMP Bulk Walk Enumeration attempts. It triggers when UDP traffic on port 161 (SNMP) contains the case-insensitive string "private" and exceeds a threshold of 10 occurrences from the same source IP within 30 seconds. This activity is indicative of an adversary performing reconnaissance to gather information about network devices.
This rule detects attempts to enumerate SNMP community strings by looking for UDP traffic on port 161 containing the string "public" (case-insensitive). It uses a threshold of 10 occurrences within 30 seconds from the same source IP to identify potential scanning activity.
This rule detects DNS ANY record queries, which can be used for reconnaissance purposes. An ANY record query (QTYPE=255 or 0xFF) requests all available record types for a given domain. While legitimate uses exist, it is often abused by attackers to gather extensive information about a target's DNS infrastructure, making it a common indicator of reconnaissance activity.
This rule detects a DNS reverse lookup sweep, which is characterized by a high volume of DNS queries for reverse IP addresses (in-addr.arpa) within a short period. Specifically, it triggers an alert if 20 such queries are observed from a single source IP within 30 seconds. This activity is often indicative of reconnaissance efforts by an attacker to map out internal network infrastructure.
UDP Traceroute Network Discovery
Suricata
This rule detects UDP traceroute network discovery attempts. It triggers an alert when UDP packets with a Time-To-Live (TTL) value less than 5 are observed, with a threshold of 10 such events from the same source within 10 seconds. This behavior is indicative of network scanning to map network topology.
This rule detects potential DNS hijacking attempts via a compromised resolver. It specifically looks for UDP traffic on port 53 (DNS) to the home network, containing the DNS response code '81 80' (indicating a standard query response) and the PCRE pattern '/\x00\x01\x00\x00/' which corresponds to a single question in the DNS query. A threshold of 20 occurrences within 10 seconds from the same source IP triggers the alert, suggesting a high volume of suspicious DNS responses.
This rule detects Wake-on-LAN (WoL) magic packets. WoL is a network standard that allows a computer to be turned on or woken up by a network message. While legitimate, adversaries can use WoL to activate compromised systems (implants) for command and control or other malicious activities, especially if the system was previously shut down to evade detection.
This rule detects an anomaly in Kerberos Ticket Granting Ticket (TGT) requests. Specifically, it triggers an alert if more than 50 UDP Kerberos TGT requests are observed from a single source IP address within a 10-second window to the home network on port 88. This behavior could indicate an attempt to enumerate valid user accounts or perform credential stuffing/brute-force attacks against the Kerberos authentication system, potentially as part of a privilege escalation attempt (ATT&CK T1134).
This rule detects potential audio stream exfiltration using the Real-time Transport Protocol (RTP). It specifically looks for UDP traffic with a packet size between 160 and 200 bytes, which is characteristic of some RTP audio streams. A threshold of 100 such packets from the same source within 10 seconds triggers the alert, indicating a sustained audio stream.
This rule detects a UDP flood Denial of Service (DoS) attack targeting the home network. It triggers an alert if more than 1000 UDP packets are observed from any source to any destination within the home network within a 5-second interval, tracked per destination.
ET INFO WatchGuard Fireware OS IKEv2 Unauthenticated Vulnerable Version Disclosure (CVE-2025-9242)
Page 5 of 5