Ank Proton

@ank2050

0 followers40 downloads3 copies2 likes103 views

1 detection

Filters

Last updated

All Time

Detection languages

Splunk (SPL)1

Platforms

Network (Generic)1

MITRE Techniques

T1590 - Gather Victim Network Information1

T1592 - Gather Victim Host Information1

T1595 - Active Scanning1

T1595.001 - Scanning IP Blocks1

T1595.002 - Vulnerability Scanning1

Akamai WAF: Broad Scanning or Reconnaissance Activity

SPL

This rule identifies a source IP address that is triggering a variety of Akamai WAF rules across multiple hosts, which is indicative of broad scanning or reconnaissance activity. It aggregates events by source IP within 30-minute windows, counting distinct WAF rules and hosts targeted. The rule then applies thresholds to identify suspicious behavior, specifically looking for an IP that triggers more than 5 distinct WAF rules, targets more than 2 distinct hosts, and generates over 10 denied events.

Ank Proton@ank2050

Detections.ai Community

1 year ago

32103