Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
This rule detects a high volume of outbound TCP communication from the home network to any destination on port 8080. This pattern can indicate a compromised server acting as a proxy or engaging in other suspicious network activity, potentially for resource development or command and control.
This rule detects potential command and control (C2) activity where a compromised WordPress site is used as a relay. It specifically looks for HTTP POST requests to URIs containing "wp-admin" with a data size greater than 1000 bytes. A threshold of 5 such events within 60 seconds from the same source IP triggers the alert, indicating a potential high volume of C2 communication.
This rule detects attempts to sell or exchange VPN credentials by looking for the keywords "vpn" and "credentials" in the client body of HTTP traffic. This could indicate an attacker attempting to monetize stolen VPN access or an insider threat attempting to leak sensitive access information.
This rule detects potential employee directory enumeration attempts via web requests. It triggers when HTTP URI content contains both 'directory' and 'people' (case-insensitive) within a 60-second window from the same source IP, with a threshold of 10 occurrences. This behavior is indicative of an attacker attempting to discover employee information or organizational structure.
This rule detects potential email address harvesting via web scraping by identifying a high volume of HTTP GET requests to URIs containing the word "contact" within a short timeframe from a single source IP address. The threshold is set to 30 requests within 30 seconds, indicating automated or rapid access attempts often associated with scraping activities.
This rule detects a high rate of HTTP GET requests from a single source IP address to internal web servers, indicating a potential reconnaissance activity. Specifically, it triggers if a source IP makes 50 or more HTTP GET requests within a 30-second window. This behavior could be indicative of an attacker attempting to map out web application structure or discover vulnerabilities.
This rule detects attempts to harvest physical location data via web requests. It specifically looks for HTTP GET requests where the URI contains both 'location' and 'address' (case-insensitive). A threshold of 15 such requests within 30 seconds from the same source IP triggers the alert, indicating a potential network scan or automated data collection activity.
This rule detects attempts to enumerate domain trust relationships using LDAP queries. Specifically, it looks for TCP traffic on port 389 (LDAP) containing the string "(objectClass=trustedDomain)" in the server-bound flow. This string is commonly used in LDAP queries to discover trusted domains within an Active Directory environment, which can be a reconnaissance step for attackers.
Robots.txt Discovery Access
Suricata
This rule detects HTTP requests for '/robots.txt'. This file is commonly accessed by automated tools and attackers during the reconnaissance phase to understand a website's structure and identify disallowed paths. The detection is based on the URI content and is classified as a network scan.
This rule detects network traffic where the HTTP referer header contains "web.archive.org". This indicates that a user on the internal network is navigating to a website via a link from the Wayback Machine, which could be a sign of reconnaissance activity, where an attacker or insider is researching past versions of a website or looking for historical information that might no longer be publicly available on the live site. The rule specifically looks for established HTTP connections flowing to the server.
This rule detects automated web crawlers by identifying a high rate of HTTP GET requests from a single source IP address to the home network. Specifically, it triggers an alert if a source IP makes 100 or more GET requests within a 30-second window.
This rule detects bulk scraping of LinkedIn company profiles. It triggers when a client makes 20 or more HTTP requests to 'linkedin.com' with a URI containing '/company/' within a 60-second window. This behavior is indicative of automated tools attempting to extract large amounts of public company data from LinkedIn.
This rule detects attempts to access a web page on an IoT device that contains both 'about' and 'firmware' in its URI, case-insensitively. This could indicate an attacker or researcher attempting to discover firmware details or disclosure pages on IoT devices, potentially as part of a reconnaissance effort.
This rule detects attempts to enumerate firmware versions using SNMP. It specifically looks for TCP traffic on port 161 (SNMP) containing the string "sysDescr" (case-insensitive). A threshold is applied to trigger an alert if 5 such events are observed from the same source IP within a 30-second window, indicating a potential network scan for device information.
This rule detects attempts to discover the origin server behind a Content Delivery Network (CDN). It triggers when an HTTP request is made to a host containing "cdn" (case-insensitive) and the URI contains "origin" (case-insensitive). This behavior is indicative of reconnaissance activities where an attacker tries to bypass CDN protections to directly target the backend server.
This rule detects a full privileged port range scan. It triggers an alert if a source IP sends 200 TCP SYN packets to ports 0-1024 on the home network within a 10-second window. This behavior is indicative of an attacker attempting to discover open services on well-known ports.
This rule detects attempts to discover the 'security.txt' file on a web server. The 'security.txt' file is a proposed standard for security researchers to easily find contact information for reporting security vulnerabilities. Attackers or reconnaissance tools might look for this file to identify potential targets or gather information about an organization's security posture.
This rule detects potential career page scraping activity, which could be an indicator of reconnaissance by an attacker. It triggers when a client makes 15 or more HTTP requests containing 'careers' in the URI within a 30-second window, suggesting automated or rapid browsing of career-related pages.
This rule detects bulk access to web pages containing the term 'press' in their URI, indicating potential business intelligence gathering or reconnaissance activity. It triggers an alert if a single source IP makes 20 or more such requests within a 30-second window.
This rule detects a timing reconnaissance attempt against a web server, specifically looking for repeated HTTP requests to URIs containing both 'news' and 'events' (case-insensitive). The threshold of 20 requests within 30 seconds from the same source IP suggests an automated or rapid enumeration attempt to potentially infer information about the web server's response times or content availability.
This rule detects a potential client portfolio page enumeration by monitoring HTTP requests. It triggers an alert if a client makes 15 or more requests containing the string "clients" (case-insensitive) in the HTTP URI within a 30-second window. This behavior is indicative of an attacker attempting to discover or enumerate client-related pages or resources on a web server, possibly as part of a reconnaissance effort.
Page 248 of 312