Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,362 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects the upload of a malicious executable file (identified by the 'MZ' header) to a SharePoint server via the REST API endpoint for folder manipulation. Specifically, it looks for HTTP POST requests to URIs containing '/_api/web/getfolderbyserverrelativeurl' with file data that starts with 'MZ'. This indicates an attempt to upload an executable file, potentially for lateral movement or further compromise within a SharePoint environment.
This rule detects network traffic where an HTTP request is made to 'ssm.amazonaws.com' with the URI containing 'StartSession'. This combination indicates the initiation of an AWS Systems Manager (SSM) Session Manager session, which can be used for legitimate remote administration but also for lateral movement by attackers.
This rule detects a high volume of requests to download repository archives from a GitLab instance. Specifically, it triggers when 10 or more HTTP requests containing '/repository/archive' in the URI and 'gitlab.' in the HTTP host header are observed from the same source IP within a 60-second window. This behavior could indicate an attempt to exfiltrate data by bulk downloading repository contents.
This rule detects potential bulk downloads from SharePoint document libraries. It triggers when a client makes 30 or more HTTP requests to a SharePoint API endpoint related to web lists ('/_api/web/lists') within a 60-second window. This behavior can indicate an attempt to exfiltrate a large amount of data from SharePoint.
This rule detects when an Outlook OST (Offline Storage Table) file is accessed over SMB (Server Message Block) protocol. The detection is triggered by the presence of the string ".ost" (case-insensitive) in the network traffic on port 445 (SMB). This activity could indicate an attempt to collect local email data.
This rule detects when a network device configuration is transferred via TFTP. It specifically looks for UDP traffic on port 69 (TFTP's default port) and checks for the byte sequence "|00 02|" at the beginning of the payload, which corresponds to a TFTP read request (opcode 2). This activity is often associated with attackers collecting configuration files from network devices.
This rule detects Simple Network Management Protocol (SNMP) Bulk Get requests targeting port 161 on the home network, specifically looking for a content byte pattern indicative of MIB (Management Information Base) configuration data. It uses a threshold of 20 such requests within 30 seconds from the same source IP to trigger an alert, suggesting a network scan or reconnaissance activity.
This rule detects a Simple Network Management Protocol (SNMP) Management Information Base (MIB) walk dump, which is often used for configuration collection. It specifically looks for UDP traffic destined for port 161 (the standard SNMP port) within the home network, containing the byte sequence "30 82" at a depth of 2 bytes. A threshold of 50 such events from the same source within 30 seconds triggers the alert, indicating a potential network scan or reconnaissance activity.
This rule detects attempts to access network device configurations via SNMP (UDP port 161) by looking for the string "public" in the UDP payload. A threshold of 10 occurrences within 30 seconds from the same source IP is set to trigger an alert, indicating a potential network scan or reconnaissance activity targeting SNMP with a common community string.
This rule detects bulk harvesting of Microsoft Teams messages via the Graph API. It triggers when a client makes 20 or more HTTP requests within 60 seconds to graph.microsoft.com with URIs containing both '/teams/' and '/messages'. This behavior could indicate an attempt to exfiltrate a large volume of communication data from Microsoft Teams.
Page 100 of 211