Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10 detections
Filters
Last updated
All Time
Detection languages
8
2
Contributors
5
3
2
Categories
6
4
4
3
2
Platforms
7
2
1
Products / Services
7
3
2
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
Detects SMS pumping attacks via bulk SMS API requests
This rule detects a high volume of HTTP POST requests to known SMS API providers (Twilio, Nexmo, Vonage) from a single source IP address within a short timeframe. This pattern is indicative of a 'pumping attack' or SMS fraud, where an attacker attempts to generate a large number of SMS messages, often to premium rate numbers, to incur charges or exploit vulnerabilities in billing systems. The threshold is set to 20 requests within 60 seconds from the same source.
This rule detects a potential SMS Pumping Attack, specifically targeting bulk One-Time Password (OTP) requests. It triggers when a single source IP address makes more than 50 HTTP POST requests to a URI containing "send_sms" within a 60-second window. This behavior is indicative of an attacker attempting to exploit SMS delivery systems by repeatedly requesting OTPs, potentially leading to financial costs for the service provider or overwhelming users with messages.
KQL Query from file: DEVMAN ransomware detection
KQL Query
KQL Query from file: Hunting Rogue Endpoints via SMB Detection
KQL Query
KQL Query from file: CVE-2024-38200 NTLM Exposure Detection
This query identifies files that are copied to a device over SMB, then executed within a
specified threshold. Default is 5 seconds, but is configurable by tweaking the value for
ToleranceInSeconds.
specified threshold. Default is 5 seconds, but is configurable by tweaking the value for
ToleranceInSeconds.
First query digs in print spooler drivers folder for any file creations,
MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Unsigned files
or ones that don't have any relations to printers that you are using are
suspicious.
Second query that can be used for finding client machines that
could be operating print servers or file servers is also included here.
As additional mitigation for the exploit you might want to block the
incoming traffic to the SMB or EPMAP Ports (445) if you need to keep the
spooler service running to print from clients.
MANY OF THE FILES THAT SHOULD COME UP HERE MAY BE LEGIT. Unsigned files
or ones that don't have any relations to printers that you are using are
suspicious.
Second query that can be used for finding client machines that
could be operating print servers or file servers is also included here.
As additional mitigation for the exploit you might want to block the
incoming traffic to the SMB or EPMAP Ports (445) if you need to keep the
spooler service running to print from clients.