Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
205 detections
Filters
Last updated
All Time
Detection languages
117
32
20
18
9
Contributors
72
45
32
9
8
Categories
105
95
39
34
28
Platforms
108
63
28
21
16
Products / Services
75
29
29
27
27
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
2
1
1
1
IDS Classtypes
24
3
3
2
IDS Protocols
23
5
1
1
1
This rule detects anomalous access patterns on a specific IIS host (agent.3bb.co.th) by comparing recent traffic against a 30-day historical baseline. It identifies requests from accounts or source IPs not seen in the baseline, activity occurring during off-hours, or traffic from external sources. The rule further filters for high-volume or high-path diversity requests, which are indicative of automated reconnaissance or potential brute-force activity against the web application.
This rule detects anomalous access patterns on a specific IIS host (agent.3bb.co.th) by comparing recent traffic against a 30-day historical baseline. It identifies requests from accounts or source IPs not seen in the baseline, activity occurring during off-hours, or traffic from external sources. The rule further filters for high-volume or high-path diversity requests, which are indicative of automated reconnaissance or potential brute-force activity against the web application.
This rule detects anomalous access patterns on a specific IIS host (agent.3bb.co.th) by comparing recent traffic against a 30-day historical baseline. It identifies requests from accounts or source IPs not seen in the baseline, activity occurring during off-hours, or traffic from external sources. The rule further filters for high-volume or high-path diversity requests, which are indicative of automated reconnaissance or potential brute-force activity against the web application.
This rule detects anomalous access patterns on a specific IIS host (agent.3bb.co.th) by comparing recent traffic against a 30-day historical baseline. It identifies requests from accounts or source IPs not seen in the baseline, activity occurring during off-hours, or traffic from external sources. The rule further filters for high-volume or high-path diversity requests, which are indicative of automated reconnaissance or potential brute-force activity against the web application.
Detects automated reconnaissance and enumeration of sensitive web application paths (admin, config, environment files, etc.) from a single source IP. The rule identifies high-frequency request patterns that target specific non-public surface areas while excluding known search engine crawlers and monitoring bots.
This rule detects potential automated web scraping activity by identifying high-volume, repetitive network requests directed towards domains identified as government (.gov) or military (.mil). It correlates these network patterns with the execution of common browser automation frameworks (e.g., Puppeteer, Playwright) or headless browsers, indicating a likely coordinated scraping operation or bot activity.
This rule detects potential automated web scraping activity by identifying high-volume, repetitive network requests directed towards domains identified as government (.gov) or military (.mil). It correlates these network patterns with the execution of common browser automation frameworks (e.g., Puppeteer, Playwright) or headless browsers, indicating a likely coordinated scraping operation or bot activity.
This rule detects potential automated web scraping activity by identifying high-volume, repetitive network requests directed towards domains identified as government (.gov) or military (.mil). It correlates these network patterns with the execution of common browser automation frameworks (e.g., Puppeteer, Playwright) or headless browsers, indicating a likely coordinated scraping operation or bot activity.
Detects an internal source IP that has communicated with a high number of unique destination IP addresses and ports within a 24-hour period. This behavior is indicative of network reconnaissance or internal port scanning.
This rule monitors network traffic from internal devices and security logs for communication with a curated list of known malicious or suspicious scanner IP addresses, indicating potential reconnaissance or probing activity by external actors.
This rule monitors network traffic from internal devices and security logs for communication with a curated list of known malicious or suspicious scanner IP addresses, indicating potential reconnaissance or probing activity by external actors.
Detects usage of the 'finger' utility via command line within scripts or batch files, or network connections originating from the 'finger' process on port 79 to non-internal destinations. This activity is commonly associated with internal network reconnaissance to gather user information or system details.
Detects high-frequency access to 'about' pages from a single IP address, indicative of potential reconnaissance or information gathering on an organization's public-facing infrastructure. The rule filters out common search engine crawlers and triggers only when a significant number of distinct pages are requested within a short timeframe.
Detects high-frequency, automated requests to product and catalog pages within a short time window, characteristic of web scraping or catalog harvesting often used to feed fake-shop networks or build clone sites.
Detects high-frequency requests for 'tools/list' from a single source IP across multiple unique destination hosts. This pattern is indicative of a breadth-first scan attempting to identify reachable Model Context Protocol (MCP) servers, rather than typical legitimate client-to-server communication.
Detects anomalous DNS activity characterized by either unauthorized DNS zone transfer (AXFR/IXFR) requests or aggressive subdomain enumeration patterns from external IP addresses. This rule monitors for high volumes of non-standard DNS queries or distinct subdomain lookups within a 15-minute window, which are common precursors to reconnaissance activities.
Detects high-frequency requests for 'tools/list' from a single source IP across multiple unique destination hosts. This pattern is indicative of a breadth-first scan attempting to identify reachable Model Context Protocol (MCP) servers, rather than typical legitimate client-to-server communication.
Detects automated reconnaissance and enumeration of sensitive web application paths (admin, config, environment files, etc.) from a single source IP. The rule identifies high-frequency request patterns that target specific non-public surface areas while excluding known search engine crawlers and monitoring bots.
Detects high-frequency requests for 'tools/list' from a single source IP across multiple unique destination hosts. This pattern is indicative of a breadth-first scan attempting to identify reachable Model Context Protocol (MCP) servers, rather than typical legitimate client-to-server communication.
This rule monitors for active reconnaissance or scanning behavior by detecting a single source IP interacting with a high number of distinct ports/hosts within a short time frame (NetworkScan) or accessing a high number of distinct URI paths/404 errors (WebContentScan).
This rule monitors web server logs (IIS, W3C, and Azure Application Gateway) for incoming traffic that matches known malicious or automated vulnerability scanners, as well as requests for common system fingerprinting paths (such as /server-status or /.git/config). The rule aggregates these hits by source IP address to identify potential active reconnaissance or vulnerability scanning attempts.
Page 6 of 10