Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
653 detections
Filters
Last updated
All Time
Detection languages
268
245
33
31
27
Contributors
207
128
118
98
20
Categories
20,453
11,837
5,876
5,154
4,865
653
Platforms
430
207
97
32
29
Products / Services
270
154
77
73
39
MITRE Techniques
326
308
201
105
97
CVEs
5
2
2
1
1
IDS Classtypes
177
67
11
9
3
IDS Protocols
129
108
16
7
3
Detects potential port scanning activity originating from a Squid proxy server targeting FTP (port 21). This rule identifies instances where a Squid process attempts to connect to port 21 on multiple remote IPs within a one-hour window, which could indicate reconnaissance or malicious activity.
Detects potential port scanning activity originating from a Squid proxy server targeting FTP (port 21). This rule identifies instances where a Squid process attempts to connect to port 21 on multiple remote IPs within a one-hour window, which could indicate reconnaissance or malicious activity.
This rule detects network connections on port 21 (FTP) where the remote URL contains keywords indicative of NetWare directory listings or related services (netware, NDS, bindery, ncf). This could indicate an attempt to discover or interact with NetWare services, potentially exploiting vulnerabilities like Squidbleed.
Detects a small Go-based scanner, identified by its renamed executable 'go.exe', when launched with command-line arguments indicative of broad network scanning activities such as CIDR range specifications (/16, /24), service discovery, or exploit module usage. This behavior is often associated with initial access or reconnaissance phases by adversaries.
Detects anomalous device network activity involving 5G-specific protocol ports (e.g., GTP-U, SIP). The rule aggregates unique port usage per device over 1-hour intervals to identify potential network reconnaissance, scanning, or unauthorized control plane communication.
Detects ICMP ping sweeps used to discover active hosts on the network
Detects unusual connections from IT subnets to known OT/ICS protocol ports (Modbus:502, DNP3:20000, EtherNet/IP:44818, S7Comm:102, OPC UA:4840, IEC 60870-5-104:2404, BACnet/IP:18245) within private IP ranges. This rule specifically looks for a high volume of connections (more than 5) from a single source IP to different destination IPs on these OT ports, excluding traffic from Rockwell devices, which might indicate lateral movement or reconnaissance by threat actors like TheGentlemen, who have historically targeted OT environments.
Detects network service scanning for target discovery
This rule detects network connections on port 21 (FTP) where the remote URL contains keywords indicative of NetWare directory listings or related services (netware, NDS, bindery, ncf). This could indicate an attempt to discover or interact with NetWare services, potentially exploiting vulnerabilities like Squidbleed.
This rule detects a potential network scan activity where a source IP sends multiple NTP (Network Time Protocol) queries to the internal network within a short period. Specifically, it triggers if a single source IP sends 5 or more UDP packets to destination port 123 (NTP) on the home network within a 30-second window. This behavior can indicate an attacker attempting to discover systems or services on the network by querying for system time.
Detects probing of firewall and VPN management interfaces for security appliance discovery
This rule detects attempts to query the remote system time via Server Message Block (SMB) by looking for the 'NetRemoteTOD' string in network traffic destined for port 445. This activity is often associated with discovery tactics, where an attacker tries to gather information about the target system.
Detects ICMP ping sweeps used to discover active hosts on the network
This rule detects potential internal network scanning activity by identifying a single source IP address that communicates with 15 or more distinct internal destination IP addresses within a 5-minute time window. This behavior is often indicative of reconnaissance efforts by an attacker attempting to map out the internal network.
FOFA Internet Asset Search Query
Suricata
This rule detects HTTP requests where the host header contains 'fofa.info'. FOFA is an internet asset search engine, similar to Shodan. This detection indicates that a system within the HOME_NET is making queries to FOFA, which could be part of reconnaissance activities to gather information about internet-facing assets.
This rule detects Kerberos Domain Trust Discovery attempts by monitoring for a high volume of Kerberos Ticket Granting Ticket (TGT) requests to port 88 (Kerberos) on the home network. A threshold of 20 requests from a single source IP within 10 seconds triggers the alert, indicating a potential network scan activity aimed at mapping domain trusts.
Detects a device making an unusually high number of unique outbound network connections to different remote IP addresses within a short time frame (5 minutes). This behavior can indicate various malicious activities such as network scanning, botnet activity, or data exfiltration to multiple external hosts.
This rule detects unusual network connection patterns characterized by a high volume of connections to a remote IP address within a 5-minute window, combined with anomalous connection durations. Specifically, it flags scenarios where there are more than 1000 connections and either the 95th percentile of connection durations is very short (less than 50ms) or the 5th percentile of connection durations is very long (greater than 30000ms). These patterns can indicate activities such as network scanning, denial-of-service attempts, or command and control communication.
Detects high-rate GET requests to contact pages for email harvesting
Detects TCP SYN sweeping across multiple hosts for network topology mapping
Detects OS-level TCP connection exhaustion for denial of service
Page 18 of 32