Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,363 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects the delivery of a potential rootkit payload via HTTP download. It specifically looks for HTTP responses (flow:to_client) where the URI contains keywords like 'rootkit', 'rkill', 'kernel.module', or 'lkm' (case-insensitive) and the file data starts with 'MZ', indicating a Windows executable.
This rule detects HTTP responses (flow:to_client) that contain specific strings indicative of an environment-keyed payload checking the domain before execution. Specifically, it looks for the case-insensitive strings "GetComputerNameEx" and "NetworkDomain" within the file data of the HTTP response. This behavior is often associated with malware attempting to determine its execution environment to evade analysis or target specific systems.
This rule detects attempts to modify the 'Image File Execution Options' (IFEO) registry key to set a debugger for an application. This technique is often used by adversaries for persistence, allowing them to execute their malicious code whenever the legitimate application starts. The rule specifically looks for network traffic (TCP, port 445, typically SMB) containing the strings 'Image File Execution Options' and 'Debugger' in a case-insensitive manner, indicating a potential attempt to manipulate this registry setting over the network.
This rule detects HTTP responses from a server to a client that contain specific strings ('ComputerName', 'UserName', and 'MZ') within the file data. The presence of 'MZ' at the beginning (depth:2) suggests an executable file. The combination of these strings indicates a potential 'guardrail' payload checking the environment (computer name and user name) before executing, which is a common technique used by malware to evade analysis environments or target specific systems. The rule is designed to identify trojan activity related to defense evasion.
This rule detects network traffic on TCP port 445 (SMB) containing the string "AppInit_DLLs" case-insensitively. This string is associated with the AppInit_DLLs mechanism in Windows, which can be abused for process injection and persistence by loading arbitrary DLLs into user-mode processes. The rule specifically looks for this string in traffic flowing to the server on an established connection.
This rule detects character substitution obfuscation in web requests, specifically looking for three or more consecutive occurrences of URL-encoded characters that represent common path or null byte characters (e.g., '%5C' for '\', '%2F' for '/', '%00' for null, '%0A' for newline, '%0D' for carriage return). This pattern is often used by attackers to bypass security filters or to obscure malicious payloads in HTTP URIs.
This rule detects the installation of a root certificate via an HTTP response. It specifically looks for HTTP traffic flowing from the server to the client (to_client, established) where the URI contains ".cer" (case-insensitive) and the file data contains the string "-----BEGIN CERTIFICATE-----". This combination suggests a certificate file being delivered over HTTP, which could be indicative of a malicious root certificate installation attempt, often used in man-in-the-middle attacks or to establish persistence for malware.
This rule detects attempts to replace system binaries via malicious updates by inspecting HTTP responses. It specifically looks for HTTP traffic directed to the client, containing a file with the 'MZ' header (indicating a Windows executable) and a URI path that suggests a system binary location (e.g., /bin/, /sbin/, /usr/bin/). This combination indicates a potential malicious update delivering an executable to a critical system directory.
This rule detects network traffic containing the string "LSSharedFileList" (case-insensitive) on TCP port 22 (SSH). This string is associated with macOS Login Items, which can be used for persistence by adversaries. The rule specifically looks for this content in traffic flowing from the client to the server.
This rule detects the use of SVG files for HTML smuggling payloads. Specifically, it looks for HTTP responses containing an SVG file ('.svg' in the URI) that also contain '<script' and 'Blob(' within its data. This combination is indicative of an HTML smuggling technique where malicious content is hidden within a seemingly innocuous SVG file and then processed by JavaScript to construct a malicious payload, often a file download.
Page 104 of 211