Garyson Pereira
@GaryPereira26Completionist
0 followers16 downloads14 copies5 likes466 views
5 detections
Filters
Last updated
All Time
Detection languages
5
Categories
2
1
1
1
1
Platforms
2
2
2
1
Products / Services
2
2
1
1
1
MITRE Techniques
2
2
1
1
1
This rule detects modifications to the NTDS.dit file, which is the Active Directory database. Adversaries often target this file to extract credentials and other sensitive information from domain controllers. Monitoring changes to this file can indicate an attempt at credential dumping or unauthorized access to Active Directory.
This rule detects the creation of a Kubernetes pod with a privileged container. Privileged containers have full root capabilities on the host and can bypass many security mechanisms, making them a significant security risk. The rule specifically excludes system service accounts from the 'kube-system' namespace to reduce false positives from legitimate system operations.
This rule detects the creation of Kubernetes pods by non-system service accounts within namespaces that start with 'kube'. This could indicate an attempt to establish persistence or escalate privileges within the Kubernetes cluster by creating malicious pods in critical system namespaces.
This rule detects potential SQL injection attempts by looking for specific keywords and patterns within the 'cs_uri_query' field of Cloudflare WAF logs. These patterns, such as 'UNION SELECT', '' OR 1=1', 'information_schema', and '--', are commonly used in SQL injection attacks to extract information, bypass authentication, or comment out parts of SQL queries. The rule aims to identify malicious requests targeting web applications that could lead to unauthorized database access or manipulation.
This rule identifies devices that are both critical to the organization (based on exposure graph data) and are vulnerable to CVE-2024-30040. It leverages Microsoft Defender Vulnerability Management data to correlate critical assets with known vulnerabilities.