Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
58 detections
Filters
Last updated
All Time
Detection languages
29
19
4
3
3
Contributors
9
9
9
8
8
Categories
40
15
11
11
8
Platforms
41
22
5
3
2
Products / Services
21
21
11
10
7
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
1
IDS Classtypes
13
6
IDS Protocols
18
1
Detects high-frequency TCP SYN scanning activity originating from external networks targeting port 37777, commonly associated with the Dahua DVR P2P discovery service. This behavior is indicative of automated reconnaissance and scanning campaigns searching for vulnerable IoT devices.
Detects high-frequency TCP SYN packet bursts targeting port 37777 (commonly used by Dahua surveillance devices). The detection triggers when more than 50 SYN packets from a single source are observed within a 10-second window, suggesting automated reconnaissance or vulnerability scanning activity.
Detects high-frequency TCP SYN scanning activity targeting port 37777, commonly associated with the discovery of vulnerable Dahua DVR and NVR devices.
This rule detects high-frequency TCP SYN connection attempts originating from external networks targeting common administrative or tunneling ports (1723/PPTP, 1701/L2TP, 22/SSH) on internal systems. The detection uses a threshold of 100 connection attempts within 120 seconds, which is characteristic of automated reconnaissance and network scanning behavior.
This rule detects high-frequency TCP SYN connection attempts originating from external networks targeting common administrative or tunneling ports (1723/PPTP, 1701/L2TP, 22/SSH) on internal systems. The detection uses a threshold of 100 connection attempts within 120 seconds, which is characteristic of automated reconnaissance and network scanning behavior.
This rule monitors for active reconnaissance or scanning behavior by detecting a single source IP interacting with a high number of distinct ports/hosts within a short time frame (NetworkScan) or accessing a high number of distinct URI paths/404 errors (WebContentScan).
This rule detects high-frequency TCP SYN connection attempts originating from external networks targeting common administrative or tunneling ports (1723/PPTP, 1701/L2TP, 22/SSH) on internal systems. The detection uses a threshold of 100 connection attempts within 120 seconds, which is characteristic of automated reconnaissance and network scanning behavior.
This rule detects high-frequency TCP SYN connection attempts originating from external networks targeting common administrative or tunneling ports (1723/PPTP, 1701/L2TP, 22/SSH) on internal systems. The detection uses a threshold of 100 connection attempts within 120 seconds, which is characteristic of automated reconnaissance and network scanning behavior.
This rule monitors network traffic from internal devices and security logs for communication with a curated list of known malicious or suspicious scanner IP addresses, indicating potential reconnaissance or probing activity by external actors.
This rule monitors network traffic from internal devices and security logs for communication with a curated list of known malicious or suspicious scanner IP addresses, indicating potential reconnaissance or probing activity by external actors.
This rule monitors for active reconnaissance or scanning behavior by detecting a single source IP interacting with a high number of distinct ports/hosts within a short time frame (NetworkScan) or accessing a high number of distinct URI paths/404 errors (WebContentScan).
Detects high-frequency SYN scanning activity targeting TCP port 37777 (commonly associated with Dahua devices) from an external source. This behavior is indicative of automated reconnaissance or mass-scanning campaigns, such as Operation CameraSwarm, attempting to identify exposed or potentially vulnerable IoT/surveillance hardware.
This rule detects rapid SYN packet patterns from external sources targeting the Dahua proprietary port 37777, characteristic of network scanning tools like Masscan attempting to discover or identify vulnerable Dahua devices.
This rule monitors network traffic from internal devices and security logs for communication with a curated list of known malicious or suspicious scanner IP addresses, indicating potential reconnaissance or probing activity by external actors.
Detects anomalous, high-frequency inbound TCP connection attempts to port 102 (S7comm), which is used by Siemens S7 PLCs. This behavior is indicative of automated network scanning or reconnaissance targeting industrial control system (ICS) infrastructure.
This rule monitors for active reconnaissance or scanning behavior by detecting a single source IP interacting with a high number of distinct ports/hosts within a short time frame (NetworkScan) or accessing a high number of distinct URI paths/404 errors (WebContentScan).
This rule monitors network traffic to detect potential scanning activity by identifying single remote IP addresses communicating with more than 50 distinct internal hostnames within the observed timeframe. This behavior is often indicative of automated reconnaissance, such as vulnerability scanning or network discovery, performed by an adversary attempting to map the environment.
The rule identifies potential network scanning or probing activity by detecting a high frequency of network connection attempts (3 or more within a 1-minute window) directed at a specific remote port, 1313. This port is often associated with non-standard services or custom applications and may indicate reconnaissance or unauthorized service discovery.
Detects high-velocity port scanning bursts from a single source IP address targeting multiple destinations, often indicative of botnet reconnaissance activity such as the JDY botnet used to identify edge devices vulnerable to specific exploits like CVE-2026-35616.
This rule detects mass scanning activity targeting FortiGate SSL VPN login endpoints on non-standard HTTPS ports (4433, 4443, 8443, 9443, 10443, 541). It specifically looks for HTTP requests containing '/login' in the URI, indicating an attempt to find or interact with the VPN login page. The rule uses a threshold to identify mass scanning, triggering an alert if a source IP makes 10 or more such requests within 60 seconds.
This rule detects potential scanning behavior (port or host sweeps) against specific, commonly targeted service ports (e.g., 443, 80, 8080) and correlates it with suspicious HTTP URI path requests associated with common exploit attempts (e.g., OWA, ECP, or management API paths).
Page 1 of 3