Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
3
Categories
3
3
Platforms
3
Products / Services
3
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
IDS Classtypes
3
IDS Protocols
3
This rule detects a high rate of HTTP GET requests from a single source IP address to internal web servers, indicating a potential reconnaissance activity. Specifically, it triggers if a source IP makes 50 or more HTTP GET requests within a 30-second window. This behavior could be indicative of an attacker attempting to map out web application structure or discover vulnerabilities.
This rule detects bulk access to web pages containing the term 'press' in their URI, indicating potential business intelligence gathering or reconnaissance activity. It triggers an alert if a single source IP makes 20 or more such requests within a 30-second window.
This rule detects a timing reconnaissance attempt against a web server, specifically looking for repeated HTTP requests to URIs containing both 'news' and 'events' (case-insensitive). The threshold of 20 requests within 30 seconds from the same source IP suggests an automated or rapid enumeration attempt to potentially infer information about the web server's response times or content availability.