Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
4
3
1
Contributors
5
2
1
Categories
4
4
3
3
1
Platforms
6
2
Products / Services
3
1
1
1
1
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
3
IDS Protocols
3
Detects NTP reflection amplification DDoS attack traffic
This rule detects NTP Reflection Amplification DDoS attacks by looking for specific content in UDP packets destined for the home network on port 123 (NTP). The rule triggers if 50 such packets are observed from the same destination within 5 seconds, indicating a high volume of NTP traffic potentially used for amplification.
This rule detects a potential DNS Reflection Amplification Distributed Denial of Service (DDoS) attack. It triggers an alert when UDP traffic targeting port 53 (DNS) on the home network has a data size greater than 512 bytes and occurs at a rate of 100 or more packets within a 5-second window from the same destination.
Detects NTP reflection amplification DDoS attack traffic
This rule detects a CHARGEN Reflection Amplification Attack. It specifically looks for UDP traffic on port 19 (the CHARGEN service port) directed towards the home network. A threshold of 50 packets within 5 seconds, tracked by destination, is used to identify potential amplification attempts, indicating a denial-of-service attack.
KQL Query from file: CVE-2025-33073 Detection
KQL Query from file: CVE-2025-24054 NTLM Exploit in the Wild Detection
This analytic identifies a large volume of DNS ANY queries, which may indicate a DNS amplification attack. It leverages the Network_Resolution data model to count DNS queries of type "ANY" directed to specific destinations. This activity is significant because DNS amplification attacks can overwhelm network resources, leading to Denial of Service (DoS) conditions. If confirmed malicious, this activity could disrupt services, degrade network performance, and potentially be part of a larger Distributed Denial of Service (DDoS) attack, impacting the availability of critical infrastructure.
