Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9 detections
Filters
Last updated
All Time
Detection languages
5
4
Contributors
6
2
1
Categories
7
3
2
2
2
Platforms
6
3
3
1
1
Products / Services
5
3
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
2
1
IDS Protocols
2
1
1
1
Detects when a device connects to a wireless network SSID that has not been observed in the baseline over the previous 14 days.
This rule detects potentially malicious Wi-Fi network enumeration or profile creation using 'netsh' or 'nmcli', as well as the loading of 'wlanapi.dll' by non-standard, unauthorized processes. Such activities can indicate an attempt by an adversary to discover, connect to, or exfiltrate data via nearby wireless networks.
Detects credential harvesting portals from evil twin Wi-Fi access points
This rule detects potentially malicious Wi-Fi network enumeration or profile creation using 'netsh' or 'nmcli', as well as the loading of 'wlanapi.dll' by non-standard, unauthorized processes. Such activities can indicate an attempt by an adversary to discover, connect to, or exfiltrate data via nearby wireless networks.
This rule detects potential rogue DHCP servers on a wireless segment by looking for UDP traffic on port 67 (DHCP server port) with a specific DHCP message type (likely a DHCP offer or acknowledgement, indicated by '|02|' at offset 0). It uses a thresholding mechanism to trigger an alert if 3 such packets are observed from the same source within 10 seconds, which helps to reduce false positives from single, isolated packets.
This rule detects a Deauthentication (Deauth) attack pattern, specifically targeting forced Wi-Fi reconnections. It triggers an alert when a high volume (50 or more) of TCP SYN packets are observed from a single source IP address within a 5-second window directed towards the home network. This pattern is indicative of an attacker attempting to flood a Wi-Fi network with deauthentication frames, forcing legitimate clients to disconnect and then reconnect, which can be exploited for various malicious purposes like capturing handshakes or facilitating man-in-the-middle attacks.
This rule detects Address Resolution Protocol (ARP) poisoning attempts on a network segment, specifically looking for ARP reply packets (opcode 2). It uses a thresholding mechanism to trigger an alert if 10 such packets are observed from the same source within a 5-second window, indicating a potential malicious ARP spoofing activity.
This rule detects potential rogue captive portal credential harvesting pages by inspecting HTTP responses for the presence of keywords like 'captive', 'password', and 'connect' within the file data. These keywords, when found together in a client-bound HTTP response, suggest an attempt to mimic a legitimate captive portal to steal user credentials.
This rule detects attempts to capture credentials via an 'Evil Twin' access point by looking for HTTP POST requests to URIs containing both 'login' and 'wifi'. This combination suggests a malicious captive portal designed to trick users into submitting their credentials.