Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
4
2
1
Contributors
6
1
Categories
6
4
1
Platforms
7
Products / Services
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
Detects SNMP bulk walk used to collect network device configurations
Detects SNMP enumeration using default community strings
Detects enumeration of hardware asset inventories via web or network
This rule detects Simple Network Management Protocol (SNMP) Bulk Get requests targeting port 161 on the home network, specifically looking for a content byte pattern indicative of MIB (Management Information Base) configuration data. It uses a threshold of 20 such requests within 30 seconds from the same source IP to trigger an alert, suggesting a network scan or reconnaissance activity.
This rule detects a Simple Network Management Protocol (SNMP) Management Information Base (MIB) walk dump, which is often used for configuration collection. It specifically looks for UDP traffic destined for port 161 (the standard SNMP port) within the home network, containing the byte sequence "30 82" at a depth of 2 bytes. A threshold of 50 such events from the same source within 30 seconds triggers the alert, indicating a potential network scan or reconnaissance activity.
Detects SNMP-based access to network device configurations for data collection
This rule detects when an SNMP OID request is made to an OpenCanary honeypot's SNMP service. This indicates an adversary is likely performing reconnaissance to gather information about the network or devices, potentially looking for vulnerabilities or sensitive data.
