Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
653 detections
Filters
Last updated
All Time
Detection languages
268
245
33
31
27
Contributors
207
128
118
98
20
Categories
20,443
11,831
5,875
5,151
4,864
653
Platforms
430
207
97
32
29
Products / Services
270
154
77
73
39
MITRE Techniques
326
308
201
105
97
CVEs
5
2
2
1
1
IDS Classtypes
177
67
11
9
3
IDS Protocols
129
108
16
7
3
This rule detects potential VPN gateway fingerprinting attempts via the Internet Key Exchange (IKE) protocol. It triggers an alert when a source IP sends 5 or more UDP packets to port 500 (the standard IKE port) on the home network within a 30-second window. This behavior can indicate an attacker attempting to identify active VPN services or their configurations.
This rule detects a network scan targeting TCP port 4444 on the home network. It specifically looks for SYN packets (flags:S) indicating an attempt to establish a connection. A threshold of 5 connection attempts from the same source within 60 seconds triggers the alert, suggesting a port scan activity. Port 4444 is often associated with security appliance management interfaces or backdoors, making probes to this port suspicious.
This rule detects HTTP requests to known IP geolocation lookup services (ip-api.com, ipinfo.io, ipgeolocation.io). A high frequency of such requests from a single source IP within a short timeframe (10 requests in 60 seconds) could indicate reconnaissance activity, where an attacker is gathering information about target IP addresses.
This rule detects network host discovery attempts using a TCP SYN sweep. It triggers when a source IP sends 30 or more TCP SYN packets (indicated by the 'flags:S' option) to any destination on the HOME_NET within a 10-second window. This behavior is characteristic of an attacker attempting to identify active hosts on a network by sending SYN packets and observing which hosts respond with a SYN-ACK.
This rule detects HTTP requests to github.com that contain sensitive file names or patterns in the URI, such as '.env', 'config.php', 'credentials', 'secrets', or 'api_key'. This activity could indicate an attacker or malicious actor searching for sensitive information exposed in public or private GitHub repositories.
This rule detects attempts to fingerprint WordPress login pages by monitoring HTTP requests for the 'wp-login.php' URI. It triggers an alert if a source IP makes 5 such requests within 60 seconds, indicating a potential reconnaissance activity against WordPress installations.
This rule detects network traffic generated by the OpenVAS vulnerability scanner. It specifically looks for HTTP requests where the User-Agent header contains the string "OpenVAS" (case-insensitive). This indicates that an OpenVAS scanner is actively probing the network, which could be part of a legitimate security assessment or a malicious reconnaissance effort.
Stealth NULL Scan Port Probe
Suricata
This rule detects a Stealth NULL Scan Port Probe. A NULL scan is a type of port scan where all the TCP flags (URG, ACK, PSH, RST, SYN, FIN) are turned off. If the target port is closed, the target system should respond with an RST packet. If the port is open, the target system should not respond at all. This behavior can be used by attackers to map out open ports on a system while attempting to evade detection by some firewalls or intrusion detection systems that might be configured to only look for SYN packets.
This rule detects potential organization information harvesting via web scraping. It triggers when a client makes 25 or more HTTP GET requests to URIs containing the string "about" (case-insensitive) within a 20-second window. This behavior could indicate an automated script or tool attempting to gather information from a website's 'about us' or similar pages.
This rule detects a possible port knocking sequence, which is a method of externally opening ports on a firewall by generating a sequence of connection attempts to a set of closed ports. The rule specifically looks for 5 TCP SYN packets from the same source IP within a 5-second window to any port on the home network, indicating a potential port knocking attempt.
This rule detects a high rate of DNS queries from a single source IP address to the local network (HOME_NET) on UDP port 53. Specifically, it triggers an alert if more than 100 DNS queries are observed from the same source within a 10-second window. This behavior is indicative of network reconnaissance, where an attacker might be rapidly querying DNS to map out internal network resources or identify potential targets.
This rule detects potential vulnerability scanning activity by identifying multiple network connection attempts to common vulnerable ports (135, 139, 445) where the remote URL contains keywords like 'vuln' or 'scan'. It aggregates these activities by device and time, flagging devices with 5 or more such connections within an hour.
Detects repeated SSH connections used to grab banners for host information gathering
This rule detects suspicious network connections originating from internal IP addresses to common service ports (DNS, SMB, RDP, WinRM) on remote, non-internal IP addresses. It flags instances where a single process on a device makes 10 or more such connections within an hour, which could indicate reconnaissance, lateral movement, or data exfiltration attempts.
This rule detects a high volume (50 or more) of HTTP errors (status codes 400 and above) originating from a single client IP address within a 5-minute time window. This behavior can be indicative of various malicious activities such as brute-force attacks, web application vulnerability scanning, or denial-of-service attempts against a web server.
This rule detects a port knocking sequence on closed ports. It triggers an alert when four TCP SYN packets are observed from the same source IP address within a 5-second window, targeting any port on the home network. This behavior is indicative of an attacker attempting to perform port knocking to open a hidden port or service.
This rule detects a brute-force attack against an SSH service on a network device management port. It triggers an alert if 15 or more TCP SYN packets are observed from a single source IP address to destination port 22 (SSH) within a 30-second window, indicating an attempt to establish multiple connections, characteristic of a brute-force attempt.
This rule detects HTTP requests made to 'whois.domaintools.com', indicating a WHOIS domain lookup activity via a web service. It triggers an alert if five such requests are observed from the same source within 60 seconds. This activity is often associated with reconnaissance.
This rule detects potential subdomain enumeration activity by identifying a high volume of DNS queries (100 queries within 30 seconds) originating from a single source IP address to port 53 (DNS) on the home network. This behavior is indicative of an attacker attempting to discover subdomains of a target domain.
This rule detects attempts to use search engine filetype dorking techniques to discover sensitive files. It specifically looks for HTTP requests containing the string "filetype:" in the URI, which is a common operator used in search engines to filter results by file extension. This activity is often associated with reconnaissance efforts by attackers to find publicly exposed documents, spreadsheets, or other files that might contain sensitive information.
This rule detects attempts to fingerprint the version of a Drupal Content Management System (CMS) by requesting the 'CHANGELOG.txt' file. This file often contains version information and is a common target for attackers performing reconnaissance to identify potential vulnerabilities.
Page 21 of 32