Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
4
3
1
Contributors
2
1
1
1
1
Categories
3
2
2
1
1
Platforms
5
3
Products / Services
3
3
1
1
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
2
1
IDS Protocols
2
1
This rule detects a potential SYN flood denial-of-service attack, characterized by a high volume of TCP SYN packets directed at a target within a short timeframe. Such activity is indicative of attempts to exhaust server resources by leaving TCP handshakes incomplete.
Detects Cisco network devices experiencing unexpected reloads, crashes, or watchdog resets that are correlated with prior incoming WebVPN, AnyConnect, or SSL VPN HTTP requests. The rule also identifies multiple device reloads occurring within a short 15-minute window, which may indicate a distributed or repeated exploitation attempt against the SSL VPN infrastructure.
This rule detects a TCP connection flood, specifically looking for a high rate of TCP SYN packets (indicated by the 'flags:S' keyword) directed towards a single destination IP address within a short timeframe. A threshold of 500 SYN packets within 5 seconds to the same destination triggers the alert. This behavior is characteristic of a Denial of Service (DoS) attack, aiming to exhaust the target's resources by overwhelming it with connection requests.
Detects web content containing strings associated with destructive commands or unauthorized financial transactions, often embedded as part of an Indirect Prompt Injection (IDPI) attack. These prompts are designed to be executed by an AI agent or LLM, potentially leading to data loss, denial of service, or financial theft.
DOS Sustained ICMP Flood Attempt
Suricata
This rule detects a sustained ICMP flood attempt, which is a type of Denial of Service (DoS) attack. It triggers an alert if more than 100 ICMP packets (type 8, echo request) are observed from an external network to the home network within a 10-second window, tracked per source IP. This indicates an adversary is attempting to overwhelm the target system or network with ICMP traffic.
This the exploitation of a NTFS vulnerability as reported without many details via Twitter
This rule detects the exploitation of a specific NTFS vulnerability that causes file system corruption. The detection is based on Windows System event logs, specifically Event ID 55 from the 'Ntfs' provider, indicating a corrupted file record with the file name being a single backslash.
This the exploitation of a NTFS vulnerability as reported without many details via Twitter