Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9 detections
Filters
Last updated
All Time
Detection languages
5
4
Contributors
6
2
1
Categories
4
4
2
2
2
Platforms
4
3
2
1
Products / Services
4
3
2
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
4
IDS Protocols
3
1
Detects attempts to discover CDN origin servers to bypass WAF protection
Detects attempts to discover CDN origin servers to bypass WAF protection
This rule detects a TCP SYN packet (initial connection attempt) directed towards port 10443 on the home network. The message indicates this is a probe targeting a Palo Alto Firewall Management Interface. This suggests an attempt to discover or interact with a Palo Alto firewall's management interface, potentially for reconnaissance or exploitation.
This rule detects potential VPN gateway fingerprinting attempts via the Internet Key Exchange (IKE) protocol. It triggers an alert when a source IP sends 5 or more UDP packets to port 500 (the standard IKE port) on the home network within a 30-second window. This behavior can indicate an attacker attempting to identify active VPN services or their configurations.
This rule detects a network scan targeting TCP port 4444 on the home network. It specifically looks for SYN packets (flags:S) indicating an attempt to establish a connection. A threshold of 5 connection attempts from the same source within 60 seconds triggers the alert, suggesting a port scan activity. Port 4444 is often associated with security appliance management interfaces or backdoors, making probes to this port suspicious.
This rule detects a potential network scan targeting firewall management interfaces. It specifically looks for TCP SYN packets (flags:S) directed to port 8443 on the home network, which is a common port for firewall management. The rule triggers if 5 such connection attempts are observed from the same source within a 60-second window, indicating a threshold-based scan.
KQL Query from file: Critical Monitor for Critical Assets
KQL Query from file: Honeypot Threat Intelligence (TI) Data
'Discover all critical ports from a list having rules like 'Any' for sourceIp, which means that they are opened to everyone. Critial ports should not be opened to everyone, and should be filtered.'
