Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,363 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects network traffic on TCP port 445 (SMB) containing the case-insensitive string "Print Processors". This pattern is indicative of an attempt to register a malicious Print Processor DLL for persistence, a technique used by adversaries to maintain access to a system. The rule specifically looks for traffic flowing to the home network, suggesting an inbound attempt to establish persistence.
This rule detects network traffic on port 445 (SMB) where the content of the traffic contains both "Monitors" and "spoolsv" (case-insensitive). This combination of keywords suggests an attempt to register a port monitor DLL via the Print Spooler service, which is a known technique for persistence and privilege escalation.
This rule detects attempts to disable PowerShell history logging via an SSH connection. It specifically looks for the strings "Set-PSReadlineOption" and "HistorySaveStyle" within TCP traffic destined for port 22 (SSH). This activity is indicative of an attacker trying to cover their tracks by preventing their PowerShell commands from being recorded.
This rule detects potential malware payloads encrypted with RC4. It specifically looks for HTTP responses (flow:to_client,established) containing the string "RC4" (case-insensitive) and a long base64-like string (at least 100 characters, optionally ending with padding) within the file data. This combination suggests an RC4-encrypted payload being delivered to a client.
This rule detects network traffic to port 445 (SMB) containing the case-insensitive string "Authentication Packages". This string is often associated with the registration of malicious authentication package DLLs via the Windows Registry, a technique used for persistence and credential access. The rule specifically looks for this content in established TCP connections flowing to the home network.
This rule detects network traffic (TCP on port 445, typically SMB) containing the strings 'CodeIntegrity' and 'Disabled' (case-insensitive). This pattern suggests an attempt to disable code signing policies, potentially via a registry modification, which is a common defense evasion technique used by malware.
This rule detects network traffic on port 445 (SMB) containing the strings "Network Providers" and "ProviderPath" (case-insensitive). This pattern is indicative of an attempt to register a malicious Network Provider DLL for credential capture, a technique used by adversaries to persist and steal credentials.
This rule detects network traffic containing the string "/etc/pam.d/" over TCP port 22 (SSH). This could indicate an attempt to modify Pluggable Authentication Modules (PAM) configuration files, potentially for authentication bypass or persistence on a Linux system. The detection is focused on traffic originating from the home network to the home network, suggesting internal activity or a compromised host communicating within the network.
This rule detects when a bootloader file is delivered via HTTP. It specifically looks for HTTP responses (flow:to_client) where the URI contains keywords like 'bootloader', 'grub', 'bootmgr', or 'mbr' (case-insensitive) and the file data contains the magic bytes '|55 AA|', which often indicate the end of a boot sector or a master boot record.
This rule detects when an Office Add-in is loaded from a remote URL, specifically targeting graph.microsoft.com. It looks for HTTP POST requests where the host is 'graph.microsoft.com' and the URI contains 'addIns'. This activity could indicate an attempt to establish persistence or execute malicious code via Office Add-ins.
Page 105 of 211