Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,310 detections
Filters
Last updated
All Time
Detection languages
682
264
155
72
49
Contributors
237
195
187
166
110
Categories
345
308
229
217
143
Platforms
472
424
224
173
144
Products / Services
264
262
200
176
104
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,310
CVEs
5
4
3
3
3
IDS Classtypes
103
67
24
23
12
IDS Protocols
167
51
16
14
7
This rule detects HTTP requests to known BGP route lookup services (bgp.he.net, bgpview.io, ipwhois.io). This activity is often associated with reconnaissance, specifically IP block discovery, where an attacker or red team member is gathering information about an organization's network infrastructure.
This rule detects network host discovery attempts via UDP sweeps. It triggers an alert when a single source IP sends 30 or more UDP packets within a 10-second window to various destinations on the home network. This behavior is indicative of an attacker attempting to map out active hosts on a network.
Sitemap File Discovery Access
Suricata
This rule detects HTTP requests to URIs that contain both 'sitemap' and '.xml' (case-insensitive). This pattern is commonly associated with the discovery of sitemap files, which are used by search engines to crawl websites. Attackers or reconnaissance tools might access these files to map out a website's structure and discover hidden or unlinked pages, which can then be used for further attacks.
This rule detects potential Google Dorking activity targeting a specific site. It triggers when a client makes 10 or more HTTP requests within 60 seconds to 'google.com' where the URI contains 'site:'. This pattern is indicative of an attacker or reconnaissance tool using Google's search operators to find information about a target domain.
This rule detects potential TLS client configuration fingerprinting activity. It triggers an alert when a client sends 20 or more TLS Server Name Indication (SNI) requests to a server within a 30-second window. This behavior can be indicative of reconnaissance activities where an attacker is attempting to identify services or configurations on a target network by observing TLS handshakes.
This rule detects HTTP requests to a web server that contain both 'firmware' and 'version' in the URI, case-insensitively. This pattern is often associated with attempts to access router firmware version information pages, which could be part of reconnaissance activities.
This rule detects an SNMP Hardware MIB Enumeration Walk. It triggers when a TCP connection to port 161 (SNMP) on the home network contains the byte sequence "30 82" at a depth of 2 bytes. A threshold is set to trigger an alert if 20 such events occur within 30 seconds from the same source IP address. This activity is classified as a network scan, specifically reconnaissance, as it involves querying SNMP for hardware information.
This rule detects attempts to enumerate hardware asset inventory information via web requests. It triggers when HTTP requests contain both 'asset' and 'inventory' in the URI, indicating a potential reconnaissance activity to gather information about an organization's hardware assets. A threshold of 10 such requests within 60 seconds from the same source IP is set to reduce false positives.
This rule detects web path fuzzing activity by identifying the 'dirsearch' string in the HTTP User-Agent header. Dirsearch is a common tool used for discovering web directories and files, often employed in reconnaissance phases of attacks or security assessments.
This rule detects HTTP traffic where the User-Agent header contains the string "Burp" (case-insensitive). This is indicative of traffic generated by Burp Suite, a popular web vulnerability scanner and proxy tool. The rule specifically looks for traffic flowing from the internal network to a server.
High Port Range Scan Detected
Suricata
This rule detects a high port range scan by monitoring TCP connections with the SYN flag set (indicating a new connection attempt) to ports within the high range (1025-65535) on the home network. It triggers an alert if more than 200 such connection attempts are observed from a single source IP address within a 10-second window.
Supplier Chain Page Enumeration
Suricata
This rule detects potential enumeration of supplier-related pages on a web server. It triggers when a client makes 15 or more HTTP requests containing the case-insensitive string "supplier" in the URI within a 30-second window. This behavior could indicate an attacker attempting to discover sensitive information or entry points related to an organization's supply chain.
This rule detects bulk access to the 'about-us' page on a web server. It triggers an alert if a single source IP makes 15 or more HTTP requests containing 'about-us' in the URI within a 30-second window. This behavior can indicate reconnaissance activity, where an attacker is rapidly enumerating or scraping information from a company's public-facing web pages.
This rule detects network connections to known exploit sales platforms such as exploit.in, 0day.today, and leakbase. It specifically looks for HTTP traffic where the host header matches one of these domains, indicating potential access to marketplaces for exploits and zero-day vulnerabilities.
This rule detects HTTP requests that appear to be credential phishing attempts, specifically looking for pages that might also attempt to bypass multi-factor authentication (MFA). It triggers when an HTTP URI contains the keywords "token", "verify", and "auth" (case-insensitive). This combination of keywords in the URI suggests a page designed to collect credentials and potentially an MFA bypass token.
This rule detects bulk scraping of 'team' or 'roles' pages on a web server. It triggers an alert if a client makes 15 or more HTTP requests containing 'team' (case-insensitive) in the URI within a 30-second window. This behavior is indicative of reconnaissance activities, specifically collecting information about an organization's structure or personnel.
This rule detects the download of common Remote Access Tools (RATs) such as AnyDesk, TeamViewer, UltraViewer, RustDesk, and Zoho Assist. It specifically looks for these keywords in the HTTP URI during client-to-server HTTP traffic. The rule is categorized as 'trojan-activity' and is intended to alert when a user might be downloading these tools, potentially after social engineering or phone contact, as suggested by the rule's message.
This rule detects attempts to access typosquatted domains commonly used in phishing attacks. It specifically looks for HTTP requests where the host header contains variations of popular brand names like 'microsoft', 'google', 'paypal', 'amazon', and 'linkedin' with common typos (e.g., 'micros0ft', 'g00gle', 'paypa1', 'arnazon', 'linkedln'). The rule triggers on established HTTP connections to the server.
This rule detects HTTP traffic where the HTTP referer header indicates a social media platform (LinkedIn, Twitter, Facebook, Instagram) and the HTTP URI contains the string 'login'. This combination suggests a potential social media phishing attempt, where a user is redirected from a legitimate social media site to a credential harvesting page.
This rule detects potential scraping activity targeting LinkedIn job listings. It triggers an alert when a single source IP makes 20 or more HTTP requests to 'linkedin.com' with a URI containing '/jobs/' within a 60-second window. This behavior could indicate an automated script or tool attempting to collect job information for various purposes, including competitive intelligence, data aggregation, or reconnaissance.
This rule detects enumeration of job listing pages on web servers, likely for tech stack reconnaissance. It triggers when a client makes 15 or more HTTP requests containing 'jobs' in the URI within a 30-second window to the same server. This behavior can indicate an attacker attempting to gather information about an organization's technology stack by analyzing job descriptions, which often mention specific software, systems, or programming languages.
Page 40 of 63