Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
205 detections
Filters
Last updated
All Time
Detection languages
117
32
20
18
9
Contributors
72
45
32
9
8
Categories
105
95
39
34
28
Platforms
108
63
28
21
16
Products / Services
75
29
29
27
27
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
2
2
1
1
1
IDS Classtypes
24
3
3
2
IDS Protocols
23
5
1
1
1
Detects an nginx HTTP Server response header containing a version number identified as vulnerable to CVE-2026-42533 (specifically 0.9.6 through 1.30.3, or 1.31.0 through 1.31.2). This rule identifies potentially exposed or unpatched infrastructure that may be susceptible to exploitation.
Detects high-frequency requests to WordPress REST API batch endpoints, which are commonly used in automated exploitation or scanning attempts against WordPress installations. An unusual volume of these requests from a single client IP within a short time window is a strong indicator of unauthorized probing or exploit activity.
This rule detects the execution of the Screaming Frog SEO Spider application followed by outgoing network traffic to web ports (80/443). Screaming Frog is a legitimate web crawler often repurposed by adversaries for internal or external network reconnaissance and site scraping.
Detects authentication and Office activity where User-Agent strings match known malicious, reconnaissance, scanning, or C2 tool fingerprints. Helps identify automated attacks, credential stuffing, and adversary tooling.
This rule detects potential reconnaissance activity by identifying IP addresses that generate a high volume of HTTP requests with user agents indicating bots, crawlers, or scanners. It counts requests per IP address within one-hour bins and flags those with 50 or more such requests.
Detects potential exploitation attempts against management interfaces of SOHO network devices (Cisco, Ubiquiti, Draytek) by monitoring for suspicious web request activity, specifically targeting paths like /admin, /cgi-bin, or /setup.cgi. The rule identifies high-volume or systematic scan patterns from external sources, which may indicate automated exploitation attempts (e.g., related to CVE-2026-35616).
This rule monitors ServiceNow API traffic for high-volume requests originating from unauthenticated or guest accounts, particularly outside of standard business hours. It uses time-windowed aggregation to detect potential brute force, unauthorized scanning, or enumeration attempts against the ServiceNow platform.
Detects authentication and Office activity where User-Agent strings match known malicious, reconnaissance, scanning, or C2 tool fingerprints. Helps identify automated attacks, credential stuffing, and adversary tooling.
This rule detects potential enumeration of ServiceNow API endpoints or unauthorized access attempts from a known malicious IP address. It monitors HTTP header events specifically for common ServiceNow API patterns, aggregating requests to identify high-volume activity or interactions with sensitive endpoints like 'related_list_edit'.
This rule detects anomalous spikes in inbound network connections to common edge device management ports (80, 443, 8080, 8443) by baselining the number of unique source IP addresses per destination over a 30-day window. It triggers an alert when the hourly count of unique source IPs deviates significantly (greater than 3 standard deviations) from the historical mean, which may indicate active network scanning or brute-force attempts.
Detects anomalous, unauthenticated access to API endpoints commonly associated with table enumeration, often targeting ServiceNow interfaces or similar REST APIs. The rule monitors for a high volume of unique API paths or tables requested by a single IP address without an authorization token present, as well as tracking access from known malicious IP addresses.
Detects queries to internet scan databases used for target reconnaissance
Detects anomalous device network activity involving 5G-specific protocol ports (e.g., GTP-U, SIP). The rule aggregates unique port usage per device over 1-hour intervals to identify potential network reconnaissance, scanning, or unauthorized control plane communication.
Detects anomalous device network activity involving 5G-specific protocol ports (e.g., GTP-U, SIP). The rule aggregates unique port usage per device over 1-hour intervals to identify potential network reconnaissance, scanning, or unauthorized control plane communication.
Detects the execution of various reconnaissance tools and scripts identified as part of the Kimera framework, utilized by the threat actor group MexicanMafia in Operation Escaneo. This rule monitors for specific tool names (subfinder, assetfinder, gobuster, dnsx, naabu, httpx, gowitness, findomain), associated Python scripts, and specific command-line arguments indicative of aggressive scanning behavior.
Detects execution of known reconnaissance tools and scripts associated with the Kimera framework, including subdomain and asset enumeration utilities (e.g., subfinder, nuclei, httpx) or custom Python scripts. The rule also monitors for reconnaissance-related ulimit adjustments and concurrent bursts of multiple enumeration tools, which are indicative of automated scanning activity.
Detects high-frequency requests (over 30 unique paths within a 5-minute window) to sensitive VPN-related URL paths that result in 403 (Forbidden) or 404 (Not Found) status codes from non-internal IP addresses. This behavior is indicative of an adversary performing directory enumeration or vulnerability scanning on public-facing infrastructure.
Detects high-frequency requests (over 30 unique paths within a 5-minute window) to sensitive VPN-related URL paths that result in 403 (Forbidden) or 404 (Not Found) status codes from non-internal IP addresses. This behavior is indicative of an adversary performing directory enumeration or vulnerability scanning on public-facing infrastructure.
Detects the execution of known network scanning and reconnaissance tools (e.g., fscan, httpdf) or commands containing specific suspicious strings often associated with threat actor activity.
Detects access to robots.txt and sitemap files for web structure reconnaissance
Detects queries to internet-wide scan databases for target infrastructure reconnaissance
Page 8 of 10