Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
4
2
1
1
Contributors
3
2
1
1
1
Categories
3
3
3
3
2
Platforms
3
3
2
2
1
Products / Services
3
2
2
2
2
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
1
IDS Classtypes
2
IDS Protocols
2
Detects potential Denial of Service (DoS) against AI/LLM inference endpoints. It monitors for high-frequency request spikes or abnormally large request payloads (oversized context windows) directed at common model endpoints that could lead to disproportionate compute resource consumption.
Detects a significant surge of bulk or spam mail quarantine events for a single mailbox within a 15-minute window. This behavior often indicates a mail-bombing attack intended to overwhelm the user or as a distraction technique (smokescreen) to hide concurrent malicious activities such as exfiltration, lateral movement, or ransomware staging in the M365 tenant.
This rule monitors Zscaler Internet Access logs for high volumes of session activity, specifically detecting when a user exceeds a burst threshold of new session creations or consistently operates near the maximum allowed concurrent session limit within a 10-minute window. This behavior may indicate account compromise, automated credential stuffing, or abuse of access policies.
Detects SSH client processes linked to libssh2 (such as ssh, curl, sftp, scp) exhibiting sustained high CPU usage (>=95%) for more than 60 seconds while maintaining an active outbound SSH connection. This behavior is consistent with the denial-of-service vulnerability CVE-2026-55199, where an attacker-controlled SSH server provides an excessively large extension count during the key exchange process, triggering an infinite loop within the libssh2 library.
Detects nmap processes performing IPv6 scans (using flags such as -6) that result in abnormal process termination or the spawning of unexpected child processes (e.g., cmd.exe, sh, bash). This behavior is indicative of exploitation attempts targeting the nmap IPv6 extension header length integer wrap vulnerability, including the execution of associated PoC harness binaries.
Detects VLC media player crash conditions or suspicious child process creation immediately following the processing of VP9-encoded video files (.webm, .mkv). This behavior is indicative of potential memory corruption exploitation, such as the vlc-vp9-reschange-crash-poc, which aims to leverage malformed resolution change events for application instability or code execution.
This rule detects a Slowloris Slow HTTP DoS attack. It triggers when a single source IP sends 100 HTTP GET requests within a 300-second window to the internal network. Slowloris attacks work by holding open many HTTP connections to a web server, eventually exhausting the server's connection pool and making it unavailable to legitimate users.
This rule detects an application layer HTTP POST flood, which is a type of Denial of Service (DoS) attack. It triggers when a single destination receives 200 or more HTTP POST requests within a 10-second window. This high volume of POST requests is indicative of an attempt to exhaust server resources or bandwidth.