Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
304 detections
Filters
Last updated
All Time
Detection languages
161
41
35
31
16
Contributors
117
32
24
22
21
Categories
195
89
66
58
57
Platforms
112
82
58
58
26
Products / Services
67
46
45
44
42
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
5
2
2
2
1
IDS Classtypes
35
3
2
1
1
IDS Protocols
37
3
1
1
These rules monitor for suspicious WordPress authentication activity, including brute force and credential spraying attacks targeting XML-RPC endpoints and the standard wp-login.php interface. The rule set includes detections for high-frequency login attempts and subsequent indicators of potential successful authentication.
Detects repeated authentication login attempts (opcode 0xA0) against Dahua Easy4IP devices over TCP port 37777, indicative of a brute-force or credential stuffing attack.
Detects high-concurrency brute-force attempts against Dahua Easy4IP-enabled devices targeting port 37777, identified by specific binary patterns (opcode 0xA0) in the packet payload. This indicates an automated attempt to compromise device authentication.
Detects high-frequency failed RDP authentication attempts (Windows Event ID 4625 with LogonType 10) originating from the same source. This pattern is indicative of brute-force or credential guessing attacks against Remote Desktop Services.
Detects repeated authentication login attempts (opcode 0xA0) against Dahua Easy4IP devices over TCP port 37777, indicative of a brute-force or credential stuffing attack.
Detects high-frequency login attempts directed at the management CGI interface of Dahua camera devices. The rule identifies multiple attempts from a specific source IP towards the camera's authentication endpoints (login, RPC2_Login) over common management ports (80, 37777).
Detects high-frequency login attempts directed at the Dahua Easy4IP SDK port 37777, consistent with automated brute-force toolkits like async_brute.py. The rule monitors for a specific packet sequence indicating authentication attempts within a short timeframe.
Detects high-concurrency brute-force attempts against Dahua Easy4IP-enabled devices targeting port 37777, identified by specific binary patterns (opcode 0xA0) in the packet payload. This indicates an automated attempt to compromise device authentication.
Detects repeated authentication attempts over PPTP (port 1723) or L2TP (port 1701) protocols originating from an external network, indicative of potential brute-force activity against remote access services.
Detects repeated authentication attempts over PPTP (port 1723) or L2TP (port 1701) protocols originating from an external network, indicative of potential brute-force activity against remote access services.
Detects anomalous SSH authentication patterns characterized by a high volume of failed logon attempts (>= 10) originating from a specific IP address within a short timeframe (30 minutes), followed by a successful authentication to the same target device. This pattern is indicative of a successful credential brute-force or password guessing attack against an exposed SSH service.
This rule detects the repeated use of known default credentials (specifically common factory passwords) across multiple device hostnames. It monitors process command lines or event log data for password patterns matching specific hardcoded strings associated with camera device vulnerabilities. By aggregating hits across different devices, it identifies potential automated brute-force or credential-stuffing campaigns targeting IoT camera infrastructure.
This rule detects the repeated use of known default credentials (specifically common factory passwords) across multiple device hostnames. It monitors process command lines or event log data for password patterns matching specific hardcoded strings associated with camera device vulnerabilities. By aggregating hits across different devices, it identifies potential automated brute-force or credential-stuffing campaigns targeting IoT camera infrastructure.
Detects high-frequency HTTP requests to the Dahua easy4ipcloud.com password recovery endpoint. The rule monitors for abnormal volumes of reset requests from a single IP address, which is indicative of an attacker attempting to use offline-generated recovery codes to bypass authentication on Dahua IoT devices.
Detects anomalous SSH authentication patterns characterized by a high volume of failed logon attempts (>= 10) originating from a specific IP address within a short timeframe (30 minutes), followed by a successful authentication to the same target device. This pattern is indicative of a successful credential brute-force or password guessing attack against an exposed SSH service.
Detects a pattern of multiple failed authentication attempts (brute force) from an external IP address followed by a successful authentication event on remote access services such as RDP, VPN, or NTLM. The rule filters for non-private IP addresses and flags successes occurring outside of standard business hours.
This rule detects high-frequency account and email address enumeration attempts. It monitors syslog data for SMTP commands such as VRFY, EXPN, or RCPT TO, and analyzes Microsoft Entra ID (SigninLogs) for authentication failures specifically associated with error code 50034 (user not found). Both behaviors are indicative of an adversary attempting to validate user identities within an environment, often as a precursor to targeted phishing or brute-force attacks.
Detects repeated authentication attempts over PPTP (port 1723) or L2TP (port 1701) protocols originating from an external network, indicative of potential brute-force activity against remote access services.
Detects repeated authentication attempts over PPTP (port 1723) or L2TP (port 1701) protocols originating from an external network, indicative of potential brute-force activity against remote access services.
Detects anomalous SSH authentication patterns characterized by a high volume of failed logon attempts (>= 10) originating from a specific IP address within a short timeframe (30 minutes), followed by a successful authentication to the same target device. This pattern is indicative of a successful credential brute-force or password guessing attack against an exposed SSH service.
Detects anomalous SSH authentication patterns characterized by a high volume of failed logon attempts (>= 10) originating from a specific IP address within a short timeframe (30 minutes), followed by a successful authentication to the same target device. This pattern is indicative of a successful credential brute-force or password guessing attack against an exposed SSH service.
Page 2 of 15