Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
653 detections
Filters
Last updated
All Time
Detection languages
268
245
33
31
27
Contributors
207
128
118
98
20
Categories
20,443
11,831
5,875
5,151
4,864
653
Platforms
430
207
97
32
29
Products / Services
270
154
77
73
39
MITRE Techniques
326
308
201
105
97
CVEs
5
2
2
1
1
IDS Classtypes
177
67
11
9
3
IDS Protocols
129
108
16
7
3
This rule detects attempts to query AWS CloudTrail logs for activity discovery. Specifically, it looks for HTTP traffic to 'cloudtrail.amazonaws.com' with the URI containing 'LookupEvents'. This activity could indicate an attacker attempting to understand the environment or their own actions.
This rule detects potential email directory enumeration attempts by monitoring HTTP requests. It triggers when a client sends 10 or more HTTP requests within 30 seconds to the server, where each request URI contains both an '@' symbol and '.com'. This pattern is indicative of an attacker trying to guess valid email addresses on a domain.
This rule detects network topology discovery attempts via ICMP host sweeps. It triggers an alert when a source IP sends 50 or more ICMP echo requests (type 8) within a 10-second window to the local network. This behavior is indicative of an attacker trying to identify active hosts on a network.
This rule detects DNS queries for Mail Exchanger (MX) records. A high volume of MX record lookups from a single source IP address within a short timeframe (10 queries in 30 seconds) is indicative of network scanning activity, specifically reconnaissance to discover mail servers. This could be a precursor to targeted attacks like phishing or email spoofing.
WHOIS Database API Bulk Query
Suricata
This rule detects HTTP requests to known WHOIS database API services (whoisxmlapi.com, whoisfreaks.com, whoapi.com). Such activity could indicate an attempt to perform bulk reconnaissance on domains or IP addresses, potentially for malicious purposes like phishing, infrastructure mapping, or identifying targets.
This rule detects the presence of the Acunetix Web Vulnerability Scanner based on its unique User-Agent string in HTTP traffic. It specifically looks for the case-insensitive string "acunetix" within the HTTP User-Agent header in traffic flowing from the internal network to an external server.
This rule detects enumeration of organization profiles on Crunchbase.com by monitoring HTTP traffic for connections to 'crunchbase.com' with a high frequency (15 times in 60 seconds) from a single source IP address. This behavior is indicative of a network scan or automated data collection activity.
This rule detects potential reconnaissance activity targeting investor relations pages on a web server. It triggers when a client makes 10 or more HTTP requests containing the word "investor" (case-insensitive) in the URI within a 30-second window. This could indicate an attacker attempting to gather information about a company's financial status, ownership, or other sensitive details often found on investor relations sections of websites.
This rule detects potential vulnerability scanning activity by identifying devices making multiple successful network connections to specific ports commonly used by vulnerability scanners (8834, 8889, 1241). A device is flagged if it makes 3 or more such connections within a one-hour window.
This rule detects potential vulnerability scanning activity by identifying devices making multiple successful network connections to specific ports commonly used by vulnerability scanners (8834, 8889, 1241). A device is flagged if it makes 3 or more such connections within a one-hour window.
HTTP Server Banner Grabbing
Suricata
This rule detects HTTP server banner grabbing activity. Specifically, it triggers when a client sends a 'HEAD' HTTP request to a server on port 80, and this activity occurs at a high frequency (20 times within 30 seconds from the same source IP). Banner grabbing is a reconnaissance technique used to identify the type and version of web servers, which can then be used to find known vulnerabilities.
LDAP Domain Trust Enumeration
Suricata
This Suricata rule detects attempts to enumerate domain trusts via LDAP. It specifically looks for TCP traffic on port 389 (LDAP) where the content of the packet contains the string "(objectClass=trustedDomain)" in a case-insensitive manner. This activity is indicative of an attacker trying to discover relationships between domains, which is a common step in reconnaissance and lateral movement within an Active Directory environment.
This rule detects SSH banner grabbing attempts by monitoring TCP traffic to port 22 (SSH) on the home network. It specifically looks for the string "SSH-" within the first 4 bytes of the payload, indicating an attempt to identify the SSH server version. A threshold of 10 such events from the same source within 60 seconds will trigger an alert, classifying it as a network scan.
This rule detects LDAP user enumeration attempts by identifying multiple LDAP queries containing "(objectClass=user)" within a short timeframe (10 queries in 60 seconds) directed to a server on port 389. This behavior is indicative of an attacker trying to discover valid user accounts.
This rule detects potential network port scanning activity by identifying a single source IP address attempting to connect to 10 or more distinct destination ports on a single destination IP address within a 5-minute window. This behavior is indicative of an attacker attempting to discover open services on a target host.
This rule detects an unusually high number of network connection events originating from a single device to a remote IP address within a one-minute interval. This behavior can be indicative of various malicious activities, including network scanning, port scanning, or a denial-of-service (DoS) attempt. It could also signal a compromised host attempting to establish numerous connections for command and control, data exfiltration, or further reconnaissance.
This rule detects attempts to enumerate remote registry keys via SMB. It specifically looks for network traffic on port 445 (SMB) containing the strings "winreg" and "RegQueryValue" in a case-insensitive manner. A threshold is applied to trigger an alert if 20 such events occur within a 30-second window from the same source.
This rule detects AWS IAM user account enumeration attempts via the ListUsers API call. It triggers when five or more HTTP requests to 'iam.amazonaws.com' containing 'ListUsers' in the URI are observed from a single source IP within a 30-second window. This behavior is indicative of an attacker trying to discover valid IAM user accounts.
This rule detects attempts to enumerate email accounts using Exchange Web Services (EWS). It specifically looks for HTTP requests to the '/EWS/Exchange.asmx' URI containing the 'FindItem' content in the client body. A threshold of 10 such requests within 30 seconds from the same source IP triggers the alert, indicating a potential network scan or discovery activity targeting email accounts.
This rule detects attempts to enumerate the 'Domain Admins' group over SMB (Server Message Block) using the 'NetGroupGetUsers' function. This activity is often associated with reconnaissance by attackers trying to identify high-privilege accounts within a Windows domain.
This rule detects attempts to enumerate local group memberships on a target system via the Server Message Block (SMB) protocol. Specifically, it looks for the 'NetLocalGroupEnum' function call within SMB traffic directed to the home network on port 445. This activity is often associated with reconnaissance phases of an attack, where an adversary is trying to discover local user groups to identify potential targets for privilege escalation or lateral movement.
Page 23 of 32