Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
36 detections
Filters
Last updated
All Time
Detection languages
29
4
1
1
1
Contributors
18
7
4
2
1
Categories
27
15
10
6
4
Platforms
22
11
8
7
2
Products / Services
10
7
5
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
3
1
IDS Protocols
2
1
1
This rule detects a high volume of UDP network connections originating from a single process on a device. A count exceeding 50 UDP connections from the same process to the same remote IP address is considered anomalous and could indicate a UDP flood or other denial-of-service attempt.
This rule detects a high volume of UDP network connections originating from a single process on a device. A count exceeding 50 UDP connections from the same process to the same remote IP address is considered anomalous and could indicate a UDP flood or other denial-of-service attempt.
Detects HTTP flood application layer DDoS attacks
IoT botnet malware family used for DDoS and proxy infrastructure
This rule identifies an anomalous surge in network connection attempts to a particular remote IP address. It establishes a baseline of average daily connection counts to each remote IP over the past week. It then compares the current hourly connection count to this baseline, triggering an alert if the current count is more than five times the baseline and surpasses a total of 500 connections within that hour. This could indicate various malicious activities such as data exfiltration, command and control communication, or a denial-of-service attack originating from the monitored environment.
Detects TCP SYN flood denial of service attacks targeting internal hosts
This rule detects a direct ICMP Flood Denial of Service (DoS) attack. It triggers when more than 500 ICMP echo request (type 8) packets are sent to a single destination within a 5-second interval. This high volume of ICMP traffic is characteristic of an attempt to overwhelm a target system or network with ping requests, leading to service disruption.
This rule detects unusual network connection patterns characterized by a high volume of connections to a remote IP address within a 5-minute window, combined with anomalous connection durations. Specifically, it flags scenarios where there are more than 1000 connections and either the 95th percentile of connection durations is very short (less than 50ms) or the 5th percentile of connection durations is very long (greater than 30000ms). These patterns can indicate activities such as network scanning, denial-of-service attempts, or command and control communication.
Detects TCP SYN flood denial of service attack patterns
Detects OS-level TCP connection exhaustion for denial of service
Direct TCP SYN Flood DoS Attack
Suricata
This rule detects a direct TCP SYN flood Denial of Service (DoS) attack. It triggers when a destination IP address receives 1000 or more TCP SYN packets within a 5-second window. The 'flags:S' indicates that only packets with the SYN flag set are counted. This type of attack aims to exhaust the target's resources by initiating many half-open connections.
This rule detects a high volume of HTTP/2 requests (more than 3000 per minute) originating from a single remote IP address, especially when these requests target a diverse set of URIs (more than 10 distinct URIs). This pattern can indicate a denial-of-service (DoS) attack, a web scanner, or other malicious automated activity attempting to overwhelm a service or enumerate resources.
This rule detects a direct User Datagram Protocol (UDP) flood Denial of Service (DoS) attack. It triggers an alert if more than 1000 UDP packets are observed targeting a single destination within a 5-second window. This high volume of UDP traffic is indicative of an attempt to overwhelm a target system or network resource, making it unavailable to legitimate users.
Detects IP addresses generating a high volume of web requests to an IIS server where the referrer is external to the host. This can indicate web scraping, reconnaissance, or denial-of-service attempts.
This rule detects devices making a high volume of outbound network connections (more than 1000 connections within a one-minute window) to a single remote IP address. This behavior could indicate a network denial-of-service (DoS) attack originating from the device, or potentially other forms of high-volume network activity such as data exfiltration or scanning.
This rule detects an unusually high number of network connection events originating from a single device to a remote IP address within a one-minute interval. This behavior can be indicative of various malicious activities, including network scanning, port scanning, or a denial-of-service (DoS) attempt. It could also signal a compromised host attempting to establish numerous connections for command and control, data exfiltration, or further reconnaissance.
This rule detects a high volume of network connection retries (more than 500 within a one-minute window) to a distinct remote IP address. This behavior can be indicative of a network denial-of-service (DoS) attack, where an attacker attempts to overwhelm a target by repeatedly trying to establish connections.
This rule detects potential HTTP/2 Rapid Reset or similar denial-of-service (DoS) attacks by identifying an unusually high number of streams and total requests within a single HTTP/2 network connection over a one-minute interval. Such behavior is indicative of an attacker attempting to exhaust server resources by rapidly opening and closing streams.
This rule identifies an anomalous surge in network connection attempts to a particular remote IP address. It establishes a baseline of average daily connection counts to each remote IP over the past week. It then compares the current hourly connection count to this baseline, triggering an alert if the current count is more than five times the baseline and surpasses a total of 500 connections within that hour. This could indicate various malicious activities such as data exfiltration, command and control communication, or a denial-of-service attack originating from the monitored environment.
This rule detects an unusually high number of network connection events originating from a single device to a remote IP address within a one-minute interval. This behavior can be indicative of various malicious activities, including network scanning, port scanning, or a denial-of-service (DoS) attempt. It could also signal a compromised host attempting to establish numerous connections for command and control, data exfiltration, or further reconnaissance.
This rule detects a high volume of HTTP/2 requests (more than 3000 per minute) originating from a single remote IP address, especially when these requests target a diverse set of URIs (more than 10 distinct URIs). This pattern can indicate a denial-of-service (DoS) attack, a web scanner, or other malicious automated activity attempting to overwhelm a service or enumerate resources.
Page 1 of 2