Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
3
1
Contributors
3
1
Categories
3
2
Platforms
3
2
1
Products / Services
3
1
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
IDS Classtypes
3
IDS Protocols
2
1
This rule detects devices with a BIOS release date older than 730 days (2 years), which could indicate unpatched or outdated firmware posing security and stability risks.
This rule detects HTTP requests to a web server that contain both 'firmware' and 'version' in the URI, case-insensitively. This pattern is often associated with attempts to access router firmware version information pages, which could be part of reconnaissance activities.
This rule detects attempts to access a web page on an IoT device that contains both 'about' and 'firmware' in its URI, case-insensitively. This could indicate an attacker or researcher attempting to discover firmware details or disclosure pages on IoT devices, potentially as part of a reconnaissance effort.
This rule detects attempts to enumerate firmware versions using SNMP. It specifically looks for TCP traffic on port 161 (SNMP) containing the string "sysDescr" (case-insensitive). A threshold is applied to trigger an alert if 5 such events are observed from the same source IP within a 30-second window, indicating a potential network scan for device information.