Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
22 detections
Filters
Last updated
All Time
Detection languages
12
10
Contributors
10
8
4
Categories
21
11
8
4
4
Platforms
22
5
Products / Services
12
11
4
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
IDS Classtypes
8
3
1
IDS Protocols
8
4
Detects high-frequency access to 'about' pages from a single IP address, indicative of potential reconnaissance or information gathering on an organization's public-facing infrastructure. The rule filters out common search engine crawlers and triggers only when a significant number of distinct pages are requested within a short timeframe.
Detects high-frequency access to 'about' pages from a single IP address, indicative of potential reconnaissance or information gathering on an organization's public-facing infrastructure. The rule filters out common search engine crawlers and triggers only when a significant number of distinct pages are requested within a short timeframe.
Detects anomalous, high-frequency access to LinkedIn 'about' pages, which may indicate reconnaissance activity or attempts to gather sensitive organizational information by an adversary. The rule uses threshold-based aggregation to filter out standard search engine crawlers and identify potentially malicious scanning behavior.
This rule detects DNS queries and TLS SNI traffic directed towards identified phishing or malicious domains that mimic Passkey, Single Sign-On (SSO), or help desk authentication portals. These domains are commonly used by attackers for credential harvesting or adversary-in-the-middle (AiTM) phishing attacks targeting organizational authentication services.
Detection of DNS queries, TLS SNI, and HTTP Host headers matching domains associated with Storm-3121 and Storm-3032 phishing campaigns. These campaigns mimic identity, SSO, and passkey registration processes to capture credentials or perform token theft.
Detects high-frequency access to 'about' pages from a single IP address, indicative of potential reconnaissance or information gathering on an organization's public-facing infrastructure. The rule filters out common search engine crawlers and triggers only when a significant number of distinct pages are requested within a short timeframe.
Detects high-frequency access to 'about' pages from a single IP address, indicative of potential reconnaissance or information gathering on an organization's public-facing infrastructure. The rule filters out common search engine crawlers and triggers only when a significant number of distinct pages are requested within a short timeframe.
Detects anomalous, high-frequency access to LinkedIn 'about' pages, which may indicate reconnaissance activity or attempts to gather sensitive organizational information by an adversary. The rule uses threshold-based aggregation to filter out standard search engine crawlers and identify potentially malicious scanning behavior.
Detects anomalous, high-frequency access to LinkedIn 'about' pages, which may indicate reconnaissance activity or attempts to gather sensitive organizational information by an adversary. The rule uses threshold-based aggregation to filter out standard search engine crawlers and identify potentially malicious scanning behavior.
Detects anomalous, high-frequency access to LinkedIn 'about' pages, which may indicate reconnaissance activity or attempts to gather sensitive organizational information by an adversary. The rule uses threshold-based aggregation to filter out standard search engine crawlers and identify potentially malicious scanning behavior.
Detects anomalous, high-frequency access to LinkedIn 'about' pages, which may indicate reconnaissance activity or attempts to gather sensitive organizational information by an adversary. The rule uses threshold-based aggregation to filter out standard search engine crawlers and identify potentially malicious scanning behavior.
This rule monitors DNS queries and HTTP traffic for indicators related to known phishing infrastructure impersonating passkey and SSO providers. The domains detected are associated with Storm-3121/3032 campaigns designed to facilitate credential or session harvesting.
Detects DNS resolutions, TLS SNI, and HTTP host requests to known malicious phishing domains impersonating passkey and SSO infrastructure, often associated with Storm-3121/Storm-3032 activities.
Detects high-frequency access to 'about' pages from a single IP address, indicative of potential reconnaissance or information gathering on an organization's public-facing infrastructure. The rule filters out common search engine crawlers and triggers only when a significant number of distinct pages are requested within a short timeframe.
This rule detects potential organization information harvesting via web scraping. It triggers when a client makes 25 or more HTTP GET requests to URIs containing the string "about" (case-insensitive) within a 20-second window. This behavior could indicate an automated script or tool attempting to gather information from a website's 'about us' or similar pages.
This rule detects enumeration of organization profiles on Crunchbase.com by monitoring HTTP traffic for connections to 'crunchbase.com' with a high frequency (15 times in 60 seconds) from a single source IP address. This behavior is indicative of a network scan or automated data collection activity.
This rule detects potential reconnaissance activity targeting investor relations pages on a web server. It triggers when a client makes 10 or more HTTP requests containing the word "investor" (case-insensitive) in the URI within a 30-second window. This could indicate an attacker attempting to gather information about a company's financial status, ownership, or other sensitive details often found on investor relations sections of websites.
This rule detects HTTP traffic to 'zoominfo.com' with a high frequency (15 times in 60 seconds from the same source IP). This behavior is indicative of automated data harvesting or reconnaissance activities targeting corporate information.
This rule detects potential reconnaissance activity involving scraping LinkedIn company overview pages. It triggers when a client makes 10 or more HTTP requests to 'linkedin.com' with a URI containing '/about/' within a 60-second window. This pattern suggests automated or rapid collection of public company information from LinkedIn.
This rule detects repeated access attempts to web pages containing 'annual-report' in the URI. It triggers an alert if a single source IP makes 5 such requests within a 30-second window. This could indicate reconnaissance activity by an attacker looking for publicly available financial information.
This rule detects automated collection of organizational profile information characterized by a high rate of HTTP GET requests originating from specific user agents commonly associated with web scraping tools. It triggers an alert if a source IP makes 30 or more HTTP GET requests within a 20-second window, using user agents like 'python-requests', 'scrapy', 'curl', 'wget', or 'Go-http-client'. This behavior is indicative of reconnaissance activities, potentially for data exfiltration or vulnerability scanning.
Page 1 of 2