Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
43 detections
Filters
Last updated
All Time
Detection languages
32
4
3
1
1
Contributors
15
6
5
5
4
Categories
21
19
8
6
4
Platforms
32
8
7
3
3
Products / Services
26
5
4
4
3
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
2
1
IDS Protocols
2
This rule detects when an OpenCanary honeypot receives a Session Initiation Protocol (SIP) request. OpenCanary is a honeypot designed to detect unauthorized activity by mimicking vulnerable services. A SIP request to an OpenCanary node indicates that an attacker or scanner has interacted with the emulated SIP service, which is typically an indicator of reconnaissance or an attempted attack against voice-over-IP (VoIP) infrastructure.
Page 3 of 3