Jorden Smith
@JordenTrusted contributorCompletionist
5 followers1,092 downloads175 copies24 likes17,999 views
86 detections
Filters
Last updated
All Time
Detection languages
56
30
Categories
22
5
4
4
4
Platforms
45
2
2
Products / Services
5
5
3
1
1
MITRE Techniques
34
24
21
14
11
This rule identifies potential large file transfers from internal hosts to external hosts over the Tor network. It specifically looks for files seen on the Tor network (index=onion) originating from a local source (local_orig=true) with a size greater than 500KB (seen_bytes>500000). It excludes transfers to private IP addresses. The rule then groups these transfers by source IP, destination IP, and seen bytes, and flags instances where the same transfer (defined by source, destination, and size) occurs 5 or more times.
This rule detects the creation or modification of the 'ntds.dit' file, which is the Active Directory database. This file contains critical information, including user credentials, and its access or exfiltration is a common objective for attackers attempting to gain control over a Windows domain. The rule specifically looks for Sysmon Event ID 11, which indicates file creation, and filters for events where the 'TargetFilename' ends with 'ntds.dit'. This activity is highly suspicious and often indicative of credential dumping or reconnaissance attempts against Active Directory.
This rule detects potential suspicious activity by identifying internal hosts making frequent HTTP POST requests to external IP addresses (excluding RFC1918 and localhost ranges) over the Tor network (indicated by 'index=onion'). It counts the number of such requests from each originating host to a responding host and flags connections with 5 or more POST requests, along with the URIs and user agents involved.
This rule detects a potential brute-force attack followed by a successful login attempt against a Linux host. It specifically looks for a user account that experiences at least 10 failed password attempts within a 10-minute window, immediately followed by at least one successful password attempt for the same user on the same host within that same 10-minute window. The rule extracts the user, source IP, and port for both failed and successful attempts.
This rule detects attempts to modify or access sensitive Active Directory objects by monitoring Windows Security Event Code 4662 (An operation was performed on an object). Specifically, it looks for an Access Mask of 0x100, which indicates a 'Write Property' operation. The rule then filters for specific Object Types (GUIDs) that correspond to sensitive Active Directory objects, such as those related to domain controllers, group policy objects, or other critical infrastructure. To reduce false positives, it excludes activity from known system accounts like 'Window Manager', 'NT AUT*', 'MSOL_*', and machine accounts ending with '$'.
This rule detects large text files (over 1MB) downloaded from the Tor network (index=onion) to a local host, where the destination IP address is not a private or loopback address. It specifically looks for files with a MIME type of 'text/plain' and where 'local_orig' is true, indicating the file originated from the local network. The rule filters out internal network traffic by excluding private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback addresses (127.0.0.0/8), and APIPA addresses (169.254.0.0/16) from the responder's IP address.
This rule detects successful SSH logins from external IP addresses. It specifically looks for syslog messages indicating "Accepted password" or "Accepted publickey" and then filters out connections originating from common private IP address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback addresses (127.0.0.0/8), and APIPA addresses (169.254.0.0/16). The rule extracts the username, source IP address, and source port of the successful login.
This rule detects the use of the 'chmod' command with highly permissive file permissions (777, 0777, a=rwx, ugo+rwx, a+rwx) on Vyatta systems. This activity could indicate an attempt to weaken file system security, potentially for privilege escalation or to facilitate malware execution.
This rule detects potential web scraping or automated data exfiltration activities by identifying clients making a high number of HTTP requests (at least 5 requests within a 5-second window) to a single destination host and port. The detection is further refined by looking for patterns where these requests have very similar response body lengths (at most 3 unique sizes) and target a very limited number of URIs (at most 2 unique URIs). This behavior can indicate an automated process systematically collecting specific data from a web server.
This rule detects PowerShell or PowerShell Core processes launched by explorer.exe that contain highly obfuscated command lines. The obfuscation is identified by either an unusually long sequence of spaces (100 or more) or a sequence of 50 or more spaces followed by a hash and a drive letter (e.g., '# C:\'). This pattern is often used by malware to hide malicious commands from casual inspection and some security tools.
Page 2 of 9