Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
2
1
1
1
1
Platforms
2
Products / Services
2
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
2
IDS Protocols
1
1
This rule detects a denial-of-service attack characterized by a high volume of HTTP GET requests targeting a server within a short timeframe. Specifically, it triggers if a single destination IP address receives 500 or more HTTP GET requests within a 10-second window, indicating a potential HTTP request flood aimed at exhausting service resources.
This rule detects a potential SSL/TLS Handshake Exhaustion Attack. It triggers when a high volume of TCP SYN packets (flags:S) are observed targeting port 443 (HTTPS) on the home network within a short timeframe. Specifically, it looks for more than 200 SYN packets to the same destination within a 5-second window, indicating an attempt to overwhelm the server with handshake requests, leading to a denial of service.