Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,363 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to modify domain trust relationships via LDAP write operations. It specifically looks for TCP traffic on port 389 (LDAP) to the home network, containing the case-insensitive strings "trustType" and "trustDirection". This activity could indicate an attacker attempting to establish or alter trust relationships between domains for privilege escalation or lateral movement.
This rule detects when a Windows logon script (specifically a .bat file) is written to the NETLOGON share over SMB. This activity is often associated with persistence techniques where an attacker modifies or creates a logon script to execute malicious code when a user logs on to a domain-joined machine.
This rule detects the delivery of a payload containing the strings "Office Test" and "HKCU" over HTTP, indicating an attempt to modify the registry for persistence, potentially related to Office applications. The detection is based on inspecting file data within HTTP traffic flowing to the client.
This rule detects the creation of a new cloud account (user) in Amazon Web Services (AWS) via the Identity and Access Management (IAM) API. It specifically looks for HTTP traffic to 'iam.amazonaws.com' with 'CreateUser' in the URI, indicating an attempt to create a new IAM user.
This rule detects the upload of virtual machine disk images (VMDK, OVA, OVF, QCOW2, VHD) to cloud storage via HTTP PUT requests. The rule specifically looks for HTTP PUT methods, URIs ending with common VM image file extensions, and a minimum file size of 1MB, indicating a substantial file transfer. This activity could signify an attacker attempting to upload a backdoored or malicious VM image for persistence or to establish a foothold in a cloud environment.
This rule detects the upload of a vSphere Installation Bundle (VIB) to an ESXi host. It specifically looks for HTTP PUT requests to the '/bundle' URI with a payload size greater than 100,000 bytes, which is indicative of a VIB file transfer. This activity could be part of a persistence mechanism where an attacker installs malicious software or backdoors on an ESXi host.
This rule detects attempts to enable the 'xp_cmdshell' stored procedure in Microsoft SQL Server. The rule specifically looks for network traffic on port 1433 (default SQL Server port) containing the keywords 'sp_configure', 'xp_cmdshell', and '1' (indicating enablement). Enabling xp_cmdshell allows SQL Server to execute operating system commands, which is a common technique used by attackers for remote execution and persistence.
This rule detects attempts to establish a raw socket connection that is not TCP, UDP, or ICMP. This behavior can be indicative of a socket filter backdoor, where an attacker uses raw sockets to bypass standard network stack processing and potentially sniff or inject arbitrary network traffic. The rule specifically looks for outgoing connections from the home network to any destination where the IP protocol is not 6 (TCP), 17 (UDP), or 1 (ICMP).
This rule detects attempts to inject a malicious URL into the Outlook Home Page setting for persistence. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "HomePageURL" and "http" (case-insensitive) in the file data, indicating a potential attempt to modify Outlook's home page setting to point to an attacker-controlled URL.
This rule detects HTTP POST requests to Amazon Web Services (AWS) endpoints that are associated with non-standard or less common cloud regions. Specifically, it looks for 'amazonaws.com' in the HTTP host and then checks the HTTP URI for region codes 'ap-east' (Asia Pacific - Hong Kong), 'me-south' (Middle East - Bahrain), or 'af-south' (Africa - Cape Town). The detection is triggered when a resource creation (indicated by HTTP POST) is attempted in one of these regions, which might be unusual for an organization primarily operating in other regions, potentially indicating unauthorized activity or misconfiguration.
Page 103 of 211