Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
653 detections
Filters
Last updated
All Time
Detection languages
268
245
33
31
27
Contributors
207
128
118
98
20
Categories
20,456
11,839
5,876
5,155
4,865
653
Platforms
430
207
97
32
29
Products / Services
270
154
77
73
39
MITRE Techniques
326
308
201
105
97
CVEs
5
2
2
1
1
IDS Classtypes
177
67
11
9
3
IDS Protocols
129
108
16
7
3
This rule detects HTTP requests where the User-Agent header contains the string "ffuf" (case-insensitive). FFUF (Ffuf is a Fast Web Fuzzer) is a common tool used for web enumeration, including directory and file brute-forcing. Detection of this User-Agent indicates a potential reconnaissance activity or an attempt to discover hidden web resources.
This rule detects HTTP requests originating from the Nessus vulnerability scanner. It specifically looks for the string "Nessus" (case-insensitive) within the HTTP User-Agent header of outgoing HTTP traffic from the protected network.
This rule detects attempts to enumerate SMB network shares. It triggers when TCP traffic is directed to port 445 (SMB) on the home network, contains the SMB protocol signature, and specifically includes the string 'NetShareEnum' (case-insensitive). A threshold of 5 occurrences within 60 seconds from the same source IP is applied to reduce false positives.
This rule detects Simple Network Management Protocol (SNMP) Bulk Get requests targeting port 161 on the home network, specifically looking for a content byte pattern indicative of MIB (Management Information Base) configuration data. It uses a threshold of 20 such requests within 30 seconds from the same source IP to trigger an alert, suggesting a network scan or reconnaissance activity.
This rule detects a Simple Network Management Protocol (SNMP) Management Information Base (MIB) walk dump, which is often used for configuration collection. It specifically looks for UDP traffic destined for port 161 (the standard SNMP port) within the home network, containing the byte sequence "30 82" at a depth of 2 bytes. A threshold of 50 such events from the same source within 30 seconds triggers the alert, indicating a potential network scan or reconnaissance activity.
This rule detects attempts to access network device configurations via SNMP (UDP port 161) by looking for the string "public" in the UDP payload. A threshold of 10 occurrences within 30 seconds from the same source IP is set to trigger an alert, indicating a potential network scan or reconnaissance activity targeting SNMP with a common community string.
This rule detects attempts to enumerate logged-in users on a remote system via SMB, specifically looking for the 'NetWkstaUserEnum' string in network traffic. This activity is often associated with discovery tactics used by attackers to gain information about a target environment.
This rule detects attempts to enumerate system services on a remote host via the Server Message Block (SMB) protocol. Specifically, it looks for network traffic on TCP port 445 (SMB) containing the strings "svcctl" and "EnumServicesStatus" (case-insensitive), which are indicative of a remote service control request to list services.
This rule detects attempts to enumerate USB and peripheral devices on a Windows system via a web shell. It specifically looks for HTTP requests containing 'wmic' and 'Win32_USBHub' in the URI, indicating a WMI query to list USB devices. This activity is often associated with discovery tactics by attackers who have gained initial access to a system.
This rule detects potential Office 365 email account enumeration attempts via the Microsoft Graph API. It triggers when a source IP makes 20 or more HTTP requests within 30 seconds to 'graph.microsoft.com' with URIs containing both '/users/' and '/mailboxSettings'. This pattern is indicative of an attacker attempting to discover valid user accounts and their mailbox settings.
This rule detects attempts to enumerate AWS IAM groups via the 'ListGroups' API call. It specifically looks for HTTP traffic directed to 'iam.amazonaws.com' with 'ListGroups' in the URI, indicating a potential reconnaissance activity against AWS Identity and Access Management.
This rule detects when an attacker enumerates Azure AD group memberships via the Microsoft Graph API. It specifically looks for HTTP requests to 'graph.microsoft.com' with URI paths containing '/groups/' and '/members', indicating an attempt to list group members. A threshold is applied to detect a burst of such requests from a single source.
This rule detects HTTP requests to a Docker daemon's API endpoint (port 2375) specifically targeting the '/networks' URI. This indicates an attempt to enumerate Docker network resources, which could be part of a reconnaissance phase by an attacker to understand the containerized environment.
This rule detects HTTP requests to the Google Cloud Asset Inventory API, specifically targeting the '/assets' endpoint. This activity could indicate an attempt to enumerate cloud resources within a Google Cloud Platform environment.
This rule detects attempts to enumerate AWS S3 buckets by making HTTP requests to s3.amazonaws.com with the '?list-type=2' parameter in the URI. This type of request is commonly used to list the contents of an S3 bucket.
This rule detects attempts to enumerate AWS EC2 instances via the DescribeInstances API call. It specifically looks for HTTP traffic destined for 'ec2.amazonaws.com' with 'DescribeInstances' in the URI, indicating a potential reconnaissance activity against AWS EC2 infrastructure.
This rule detects attempts to query Windows Firewall status remotely over TCP port 445 (SMB). The detection is based on the presence of the case-insensitive string "FirewallProduct" in the network flow, indicating a potential query for firewall product information. This activity could be part of a reconnaissance phase by an attacker to understand the target's security posture.
This rule detects network traffic indicative of BloodHound's domain trust collection activity over SMB. Specifically, it looks for TCP traffic on port 445 (SMB) directed to the home network, containing the strings "(objectClass=trustedDomain)" and "SYSVOL" (case-insensitive). This combination suggests an attacker is querying Active Directory for trusted domain objects and potentially enumerating the SYSVOL share, which are common steps in BloodHound's reconnaissance phase to map out trust relationships within a domain.
This rule detects attempts to enumerate objects within a Google Cloud Storage (GCS) bucket. It triggers when HTTP requests are made to 'storage.googleapis.com' with a URI containing '/b/', indicating an attempt to access or list buckets or their contents. The thresholding mechanism (10 events within 30 seconds from the same source IP) aims to identify rapid, potentially automated, enumeration activities.
This rule detects attempts to enumerate Group Policy Object (GPO) settings by identifying LDAP queries containing the string "(objectClass=groupPolicyContainer)" over TCP port 389 (LDAP). This activity is often associated with reconnaissance or discovery phases of an attack, where an adversary is trying to understand the domain's GPO structure.
This rule detects attempts to enumerate Group Policy Objects (GPOs) by accessing the SYSVOL share over SMB. It specifically looks for SMB traffic to port 445 containing both 'SYSVOL' and 'GroupPolicy' keywords, indicating an attempt to browse or access GPO-related files. A threshold of 5 such events within 30 seconds from the same source IP triggers the alert, suggesting a potential network scan or reconnaissance activity.
Page 20 of 32