Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
Platforms
1
Products / Services
1
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
IDS Classtypes
1
IDS Protocols
1
This rule detects attempts to discover the origin server behind a Content Delivery Network (CDN). It triggers when an HTTP request is made to a host containing "cdn" (case-insensitive) and the URI contains "origin" (case-insensitive). This behavior is indicative of reconnaissance activities where an attacker tries to bypass CDN protections to directly target the backend server.
