Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6 detections
Filters
Last updated
All Time
Detection languages
3
2
1
Contributors
5
1
Categories
4
3
2
1
Platforms
6
Products / Services
3
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
1
IDS Classtypes
2
1
IDS Protocols
2
1
Detects SNMP bulk walk used to collect network device configurations
This rule detects attempts to dump router configuration via a Telnet session. Specifically, it looks for the string "show running-config" being sent to a Telnet server on the home network. This command is commonly used on network devices to display their current running configuration, and its use over an unencrypted protocol like Telnet could indicate unauthorized access or data exfiltration.
This rule detects attempts to copy the running configuration from a network device via SSH. It specifically looks for the string "show running-config" within TCP traffic destined for port 22 (SSH) on the home network. This activity is often associated with reconnaissance or data exfiltration by attackers or malicious insiders.
This rule detects when a network device configuration is transferred via TFTP. It specifically looks for UDP traffic on port 69 (TFTP's default port) and checks for the byte sequence "|00 02|" at the beginning of the payload, which corresponds to a TFTP read request (opcode 2). This activity is often associated with attackers collecting configuration files from network devices.
Detects SNMP-based access to network device configurations for data collection
Detects if the Fortinet firewall configuration has been exported.