Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6 detections
Filters
Last updated
All Time
Detection languages
3
2
1
Contributors
4
1
1
Categories
4
2
1
1
1
Platforms
3
2
2
Products / Services
3
2
1
1
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
IDS Classtypes
2
IDS Protocols
2
This rule detects a classic port knocking sequence followed by a connection to sensitive services (SSH, Telnet, RDP, VNC, WinRM). The rule identifies devices performing rapid connections to multiple different ports within a short window, which is indicative of a port knocking attempt used to trigger service exposure, followed by an immediate attempt to connect to that exposed service.
Detects port knocking sequences used to activate hidden backdoors
Detects port knocking sequences used to activate hidden network backdoors
This rule detects a port knocking sequence on closed ports. It triggers an alert when four TCP SYN packets are observed from the same source IP address within a 5-second window, targeting any port on the home network. This behavior is indicative of an attacker attempting to perform port knocking to open a hidden port or service.
This rule detects a sequence of TCP SYN packets with a zero data size, originating from any source to any destination within the home network. The detection is triggered when 5 such packets are observed from the same source within a 3-second window. This pattern is indicative of a 'Magic Packet Implant Activation Sequence', which could be used by an attacker for persistence or command and control.
Detects the execution of iptables commands used for Single Packet Authorization (SPA), a technique observed being used by UNC6201. This rule identifies when iptables is configured to inspect traffic on port 443 for a specific hex string, which is a key component of the actor's C2 proxying tradecraft.
