Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,362 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to enumerate logged-in users on a remote system via SMB, specifically looking for the 'NetWkstaUserEnum' string in network traffic. This activity is often associated with discovery tactics used by attackers to gain information about a target environment.
This rule detects potential data exfiltration of screen window lists via HTTP POST requests. It specifically looks for HTTP POST requests where the URI contains the case-insensitive string "windows" and the data size is greater than 200 bytes. This combination suggests an attempt to send information about open windows on a system to a remote server.
This rule detects attempts to enumerate system services on a remote host via the Server Message Block (SMB) protocol. Specifically, it looks for network traffic on TCP port 445 (SMB) containing the strings "svcctl" and "EnumServicesStatus" (case-insensitive), which are indicative of a remote service control request to list services.
This rule detects attempts to enumerate USB and peripheral devices on a Windows system via a web shell. It specifically looks for HTTP requests containing 'wmic' and 'Win32_USBHub' in the URI, indicating a WMI query to list USB devices. This activity is often associated with discovery tactics by attackers who have gained initial access to a system.
This rule detects potential Office 365 email account enumeration attempts via the Microsoft Graph API. It triggers when a source IP makes 20 or more HTTP requests within 30 seconds to 'graph.microsoft.com' with URIs containing both '/users/' and '/mailboxSettings'. This pattern is indicative of an attacker attempting to discover valid user accounts and their mailbox settings.
This rule detects attempts to enumerate AWS IAM groups via the 'ListGroups' API call. It specifically looks for HTTP traffic directed to 'iam.amazonaws.com' with 'ListGroups' in the URI, indicating a potential reconnaissance activity against AWS Identity and Access Management.
This rule detects when an attacker enumerates Azure AD group memberships via the Microsoft Graph API. It specifically looks for HTTP requests to 'graph.microsoft.com' with URI paths containing '/groups/' and '/members', indicating an attempt to list group members. A threshold is applied to detect a burst of such requests from a single source.
This rule detects HTTP requests to a Docker daemon's API endpoint (port 2375) specifically targeting the '/networks' URI. This indicates an attempt to enumerate Docker network resources, which could be part of a reconnaissance phase by an attacker to understand the containerized environment.
This rule detects HTTP requests to the Google Cloud Asset Inventory API, specifically targeting the '/assets' endpoint. This activity could indicate an attempt to enumerate cloud resources within a Google Cloud Platform environment.
This rule detects attempts to enumerate AWS S3 buckets by making HTTP requests to s3.amazonaws.com with the '?list-type=2' parameter in the URI. This type of request is commonly used to list the contents of an S3 bucket.
Page 101 of 211