Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
Robots.txt Discovery Access
Suricata
This rule detects HTTP requests for '/robots.txt'. This file is commonly accessed by automated tools and attackers during the reconnaissance phase to understand a website's structure and identify disallowed paths. The detection is based on the URI content and is classified as a network scan.
This rule detects network traffic where the HTTP referer header contains "web.archive.org". This indicates that a user on the internal network is navigating to a website via a link from the Wayback Machine, which could be a sign of reconnaissance activity, where an attacker or insider is researching past versions of a website or looking for historical information that might no longer be publicly available on the live site. The rule specifically looks for established HTTP connections flowing to the server.
This rule detects automated web crawlers by identifying a high rate of HTTP GET requests from a single source IP address to the home network. Specifically, it triggers an alert if a source IP makes 100 or more GET requests within a 30-second window.
This rule detects bulk scraping of LinkedIn company profiles. It triggers when a client makes 20 or more HTTP requests to 'linkedin.com' with a URI containing '/company/' within a 60-second window. This behavior is indicative of automated tools attempting to extract large amounts of public company data from LinkedIn.
This rule detects attempts to access a web page on an IoT device that contains both 'about' and 'firmware' in its URI, case-insensitively. This could indicate an attacker or researcher attempting to discover firmware details or disclosure pages on IoT devices, potentially as part of a reconnaissance effort.
This rule detects attempts to enumerate firmware versions using SNMP. It specifically looks for TCP traffic on port 161 (SNMP) containing the string "sysDescr" (case-insensitive). A threshold is applied to trigger an alert if 5 such events are observed from the same source IP within a 30-second window, indicating a potential network scan for device information.
This rule detects attempts to discover the origin server behind a Content Delivery Network (CDN). It triggers when an HTTP request is made to a host containing "cdn" (case-insensitive) and the URI contains "origin" (case-insensitive). This behavior is indicative of reconnaissance activities where an attacker tries to bypass CDN protections to directly target the backend server.
This rule detects a full privileged port range scan. It triggers an alert if a source IP sends 200 TCP SYN packets to ports 0-1024 on the home network within a 10-second window. This behavior is indicative of an attacker attempting to discover open services on well-known ports.
This rule detects attempts to discover the 'security.txt' file on a web server. The 'security.txt' file is a proposed standard for security researchers to easily find contact information for reporting security vulnerabilities. Attackers or reconnaissance tools might look for this file to identify potential targets or gather information about an organization's security posture.
This rule detects potential career page scraping activity, which could be an indicator of reconnaissance by an attacker. It triggers when a client makes 15 or more HTTP requests containing 'careers' in the URI within a 30-second window, suggesting automated or rapid browsing of career-related pages.
This rule detects bulk access to web pages containing the term 'press' in their URI, indicating potential business intelligence gathering or reconnaissance activity. It triggers an alert if a single source IP makes 20 or more such requests within a 30-second window.
This rule detects a timing reconnaissance attempt against a web server, specifically looking for repeated HTTP requests to URIs containing both 'news' and 'events' (case-insensitive). The threshold of 20 requests within 30 seconds from the same source IP suggests an automated or rapid enumeration attempt to potentially infer information about the web server's response times or content availability.
This rule detects a potential client portfolio page enumeration by monitoring HTTP requests. It triggers an alert if a client makes 15 or more requests containing the string "clients" (case-insensitive) in the HTTP URI within a 30-second window. This behavior is indicative of an attacker attempting to discover or enumerate client-related pages or resources on a web server, possibly as part of a reconnaissance effort.
This rule detects repeated HTTP requests to a web server where the URI contains the case-insensitive string "headquarters". It triggers an alert if a single source IP makes 10 such requests within a 30-second window. This behavior is indicative of an automated attempt to scrape information related to a company's headquarters address, potentially for reconnaissance purposes.
This rule detects attempts to look up physical office locations via web requests. It specifically triggers on HTTP GET requests where the URI contains both 'office' and 'location' (case-insensitive). A threshold of 10 such requests from the same source within 30 seconds is set to reduce false positives.
This rule detects HTTP responses from a server to a client that contain specific keywords ('remote', 'support', 'download') within the file data, indicating a potential fake IT support page attempting to deliver a remote access tool. The rule also checks for a minimum file size to reduce false positives.
This rule detects outbound TCP connections to port 9050, which is commonly used by Tor proxies. The rule specifically looks for the initial SYN packet (flags:S) of a TCP connection from the home network to any destination on port 9050. This activity is flagged as a policy violation, indicating the use of a Tor proxy for accessing closed source resources.
This rule detects attempts to access known online platforms used for purchasing stolen data, such as 'leakbase', 'breachforums', and 'raidforums'. It specifically looks for these keywords in the HTTP host header during client-to-server HTTP traffic.
This rule detects access to known exploit kit purchase or dark web marketplace sites by inspecting HTTP host headers for specific domain patterns. The rule triggers an alert if a client on the home network attempts to connect to any of the listed domains, which are associated with exploit kit sales or underground forums.
This rule detects HTTP responses that appear to be a phishing kit landing page. It looks for specific keywords in the HTTP response body, such as 'img', 'logo', 'password', and 'Submit', indicating a page designed to collect credentials. Additionally, it checks if the HTTP host is an IP address, which is often used in phishing campaigns to bypass domain-based reputation checks or to host pages directly on compromised servers.
This rule detects potential phishing emails sent over SMTP that request sensitive information. It looks for specific keywords in the email subject and content, such as "verify", "account", and "click here", indicating an attempt to trick the recipient into revealing credentials or other sensitive data.
Page 186 of 211