Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,310 detections
Filters
Last updated
All Time
Detection languages
682
264
155
72
49
Contributors
237
195
187
166
110
Categories
345
308
229
217
143
Platforms
472
424
224
173
144
Products / Services
264
262
200
176
104
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,310
CVEs
5
4
3
3
3
IDS Classtypes
103
67
24
23
12
IDS Protocols
167
51
16
14
7
This rule detects HTTP requests to known underground forums (nulled.to, hackforums.net, ogusers) via a clearnet proxy. It specifically looks for these hostnames in HTTP traffic.
This rule detects potential reconnaissance activity involving scraping LinkedIn company overview pages. It triggers when a client makes 10 or more HTTP requests to 'linkedin.com' with a URI containing '/about/' within a 60-second window. This pattern suggests automated or rapid collection of public company information from LinkedIn.
This rule detects repeated access attempts to web pages containing 'annual-report' in the URI. It triggers an alert if a single source IP makes 5 such requests within a 30-second window. This could indicate reconnaissance activity by an attacker looking for publicly available financial information.
This rule detects automated collection of organizational profile information characterized by a high rate of HTTP GET requests originating from specific user agents commonly associated with web scraping tools. It triggers an alert if a source IP makes 30 or more HTTP GET requests within a 20-second window, using user agents like 'python-requests', 'scrapy', 'curl', 'wget', or 'Go-http-client'. This behavior is indicative of reconnaissance activities, potentially for data exfiltration or vulnerability scanning.
SNMP Bulk Walk Enumeration
Suricata
This rule detects SNMP Bulk Walk Enumeration attempts. It triggers when UDP traffic on port 161 (SNMP) contains the case-insensitive string "private" and exceeds a threshold of 10 occurrences from the same source IP within 30 seconds. This activity is indicative of an adversary performing reconnaissance to gather information about network devices.
This rule detects attempts to enumerate SNMP community strings by looking for UDP traffic on port 161 containing the string "public" (case-insensitive). It uses a threshold of 10 occurrences within 30 seconds from the same source IP to identify potential scanning activity.
This rule detects DNS ANY record queries, which can be used for reconnaissance purposes. An ANY record query (QTYPE=255 or 0xFF) requests all available record types for a given domain. While legitimate uses exist, it is often abused by attackers to gather extensive information about a target's DNS infrastructure, making it a common indicator of reconnaissance activity.
This rule detects a DNS reverse lookup sweep, which is characterized by a high volume of DNS queries for reverse IP addresses (in-addr.arpa) within a short period. Specifically, it triggers an alert if 20 such queries are observed from a single source IP within 30 seconds. This activity is often indicative of reconnaissance efforts by an attacker to map out internal network infrastructure.
This rule detects the use of the SQLMap automated SQL injection tool by identifying the string "sqlmap" in the HTTP User-Agent header of network traffic. It specifically looks for traffic flowing to the server on established connections.
Wfuzz Directory Scanner Detected
Suricata
This rule detects the use of Wfuzz, a web fuzzer, by identifying the 'Wfuzz' string in the HTTP User-Agent header. This activity is typically associated with reconnaissance, as attackers use such tools to discover directories, files, and other web application structures.
Nikto Web Scanner Detected
Suricata
This rule detects the use of the Nikto web scanner by identifying the 'Nikto' string in the HTTP User-Agent header. Nikto is a common open-source web server scanner that performs comprehensive tests against web servers for multiple items, including dangerous files/CGIs, outdated server software, and other problems. Detection of Nikto typically indicates reconnaissance activity against a web application or server.
This rule detects attempts to fingerprint web applications by identifying the 'WhatWeb' string in the HTTP User-Agent header. WhatWeb is a web application scanner that identifies technologies used by websites, which can be an indicator of reconnaissance activity.
This rule detects network reconnaissance activity by identifying HTTP requests where the User-Agent header contains the string "masscan". Masscan is a fast internet port scanner, and its User-Agent string often indicates scanning activity, which aligns with the MITRE ATT&CK technique T1595.002 for active scanning during reconnaissance.
This rule detects suspicious DNS lookups for 'pastebin.com'. It triggers an alert if a source IP performs 5 or more DNS queries for 'pastebin.com' within a 60-second window. This activity is often associated with reconnaissance, as attackers may use Pastebin to host command and control (C2) information, exfiltrated data, or other malicious content.
Stealth TCP SYN Scan Detected
Suricata
Detects low-and-slow TCP SYN scanning activity where an attacker reduces scan rate to avoid basic threshold detection. This is common in stealth reconnaissance using Nmap or custom scanners.
This rule detects an unusually high number of network connection events originating from a single device to a remote IP address within a one-minute interval. This behavior can be indicative of various malicious activities, including network scanning, port scanning, or a denial-of-service (DoS) attempt. It could also signal a compromised host attempting to establish numerous connections for command and control, data exfiltration, or further reconnaissance.
Detects HTTP requests with known scanner or automation user-agents commonly used by reconnaissance tools like Nikto, sqlmap, or curl-based scripts. This rule specifically looks for 'sqlmap', 'nikto', 'curl', and 'python-requests' within the HTTP User-Agent header.
This rule detects an unusually high number of web search queries (identified by 'search' or 'query' in the URI) originating from a single IP address within a one-hour window. A threshold of 100 or more queries triggers the alert. This behavior could indicate automated activity such as web scraping, reconnaissance, or a denial-of-service attempt against the search functionality.
This rule detects potential employee directory enumeration attempts via web requests. It triggers when HTTP URI content contains both 'directory' and 'people' (case-insensitive) within a 60-second window from the same source IP, with a threshold of 10 occurrences. This behavior is indicative of an attacker attempting to discover employee information or organizational structure.
This rule detects potential email address harvesting via web scraping by identifying a high volume of HTTP GET requests to URIs containing the word "contact" within a short timeframe from a single source IP address. The threshold is set to 30 requests within 30 seconds, indicating automated or rapid access attempts often associated with scraping activities.
This rule detects a high rate of HTTP GET requests from a single source IP address to internal web servers, indicating a potential reconnaissance activity. Specifically, it triggers if a source IP makes 50 or more HTTP GET requests within a 30-second window. This behavior could be indicative of an attacker attempting to map out web application structure or discover vulnerabilities.
Page 41 of 63