Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
156 detections
Filters
Last updated
All Time
Detection languages
90
22
17
15
4
Contributors
38
20
18
12
9
Categories
60
42
30
30
23
Platforms
54
49
33
17
9
Products / Services
22
21
20
17
15
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
CVEs
8
8
4
3
3
IDS Classtypes
19
2
1
IDS Protocols
8
5
4
3
2
This rule detects potential exploitation of CVE-2026-86134, a NULL pointer dereference vulnerability in WatchGuard Fireware. It identifies a burst of authentication-related requests (login, authd, management) targeting a device, followed by system logs indicating a service crash, daemon restart, or core dump within a short correlation window. This behavior is indicative of a Denial of Service attack.
Detects attempts to perform a Denial of Service (DoS) attack against an AI-enabled system by flooding the inference API with high volumes of requests or overly large inputs (high token counts). The rule identifies potential resource exhaustion by correlating high request rates or large input sizes with system-wide impacts, such as increased inference queue depth or excessive GPU utilization, which could impede service availability for other users.
This rule detects an exploitation attempt targeting a memory overflow vulnerability in Citrix NetScaler Gateway, specifically identifying oversized DTLS handshake length fields in UDP traffic. The rule triggers when a DTLS packet exceeds the specified size threshold, which is indicative of a buffer overflow attack intended to cause a service crash (Denial of Service).
This rule detects potential exploitation of CVE-2026-86134, a NULL pointer dereference vulnerability in WatchGuard Fireware. It identifies a burst of authentication-related requests (login, authd, management) targeting a device, followed by system logs indicating a service crash, daemon restart, or core dump within a short correlation window. This behavior is indicative of a Denial of Service attack.
This rule detects a potential SYN flood denial-of-service attack, characterized by a high volume of TCP SYN packets directed at a target within a short timeframe. Such activity is indicative of attempts to exhaust server resources by leaving TCP handshakes incomplete.
This rule detects unauthorized or malicious agentic AI behavior where prompt injection or poisoned content causes an AI agent to execute excessive tool calls or enter an infinite loop of tool invocations. This behavior can lead to compute resource exhaustion, increased operational costs, and potential data exfiltration via excessive querying.
This rule detects potential Denial of Service (DoS) attacks against AI inference endpoints. It monitors for sustained high latency and high error rates combined with a high volume of 'heavy' requests (those exceeding a token/character count threshold) from specific source IPs. This pattern suggests an attempt to exhaust system resources by forcing the processing of complex or overly large prompts.
This rule detects potential Denial of Service (DoS) attacks against AI inference endpoints. It monitors for sustained high latency and high error rates combined with a high volume of 'heavy' requests (those exceeding a token/character count threshold) from specific source IPs. This pattern suggests an attempt to exhaust system resources by forcing the processing of complex or overly large prompts.
Detects anomalous, oversized fragmented UDP traffic (exceeding 1400 bytes) targeting or originating from the MikroTik btest service port (2000). This behavior is indicative of attempts to trigger integer underflows, system crashes, or uninitialized memory disclosures within the btest protocol implementation.
The following analytic detects when all virtual machines on an ESXi host are abruptly terminated, which may indicate malicious activity such as a deliberate denial-of-service, ransomware staging, or an attempt to destroy critical workloads.
Detects an abnormally high frequency of tool/function invocations by an AI agent within a one-minute timeframe. This pattern is indicative of a potential hijack where an attacker forces the agent into a runaway loop to perform resource exhaustion (DoS), repetitive brute-force operations, or automated exfiltration of sensitive data via manipulated tool execution.
This rule detects potential exploitation of CVE-2026-86134, a NULL pointer dereference vulnerability in WatchGuard Fireware. It identifies a burst of authentication-related requests (login, authd, management) targeting a device, followed by system logs indicating a service crash, daemon restart, or core dump within a short correlation window. This behavior is indicative of a Denial of Service attack.
This rule detects potential cost harvesting or unauthorized resource abuse by monitoring API endpoints (typically AI model gateways) for high-volume or resource-intensive queries associated with a specific identity. It correlates these patterns with billing or autoscaling trigger events (e.g., cost spikes, quota exhaustion) and identifies agentic sessions that exhibit abnormally long reasoning loops, which suggests an attempt to waste computational budget.
This rule detects a high frequency of process terminations occurring within a 5-minute window on a device where specific driver-related processes or command lines ('nvfsflt64.sys', 'Alinubx.sys') have been identified. Such behavior is characteristic of malicious activity attempting to disrupt system security components or clear traces, potentially indicating an endpoint denial of service or evasion attempt.
This rule detects anomalous spikes in API request volume for Azure Cognitive Services resources by comparing the current hourly request count against a 7-day historical baseline for the same hour-of-day. Significant increases (defined by a spike ratio threshold of 3.0 and a minimum call count of 20) may indicate potential misuse, automated scraping, unauthorized resource consumption, or potential denial-of-service activity targeting the API endpoints.
This rule detects malformed SCTP packets that trigger a protocol decoding error ('pkt_too_small'). This behavior is associated with the 'DiagSpill' vulnerability (CVE-2026-74469), where specially crafted chunk sequences in the SCTP stream can cause a remote service crash or potential instability. The rule includes a threshold to mitigate noise from non-malicious malformed packets.
Detects a specifically malformed IPv6 Routing Header (type 0) with a 'segments_left' value of 255 preceding an Authentication Header (AH). This signature targets an exploit pattern known as 'DirtyAH6', which aims to trigger a remote kernel crash or potential remote code execution on vulnerable systems by manipulating IPv6 header processing.
Detects anomalous spikes in inference API request volume per caller, correlated with increased p95 latency and elevated error rates (5xx or 408). This behavior is characteristic of a denial-of-service attack targeting AI inference endpoints, potentially exhausting backend resources and disrupting service availability.
Detects high-volume activity (BLOCK or COUNT actions) from the AWS Shield Advanced managed DDoS protection rule set within a 1-minute time window. The rule alerts on potential Layer 7 DDoS attacks by monitoring for significant spikes in event volume or the number of unique source IP addresses targeting a specific AWS WAF Web ACL.
This rule detects malformed SCTP packets that trigger a protocol decoding error ('pkt_too_small'). This behavior is associated with the 'DiagSpill' vulnerability (CVE-2026-74469), where specially crafted chunk sequences in the SCTP stream can cause a remote service crash or potential instability. The rule includes a threshold to mitigate noise from non-malicious malformed packets.
This rule detects malformed SCTP packets that trigger a protocol decoding error ('pkt_too_small'). This behavior is associated with the 'DiagSpill' vulnerability (CVE-2026-74469), where specially crafted chunk sequences in the SCTP stream can cause a remote service crash or potential instability. The rule includes a threshold to mitigate noise from non-malicious malformed packets.
Page 2 of 8