Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,363 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to register a new OAuth application within Azure Active Directory by monitoring HTTP POST requests to the Microsoft Graph API endpoint '/applications' on 'graph.microsoft.com'. This activity can be indicative of an attacker establishing persistence or gaining unauthorized access to cloud resources by creating a malicious application.
This rule detects HTTP requests that contain 'schtasks' and '/create' in the URI, indicating an attempt to create a scheduled task. This activity is often associated with adversaries establishing persistence or executing commands on a compromised system, potentially breaking the process tree for forensic analysis. The rule specifically looks for these keywords in a case-insensitive manner within the HTTP URI.
This rule detects attempts to masquerade an executable file as a PDF document during an HTTP download. It specifically looks for HTTP responses where the 'Content-Type' header is set to 'application/pdf', but the actual file data begins with the 'MZ' magic bytes, indicating it is a Windows executable.
This rule detects network connections to known command and control (C2) infrastructure associated with OMG Cable or Hak5 devices. It specifically looks for HTTP requests where the host header matches 'c2.hak5.org' or 'wifi-pineapple.com'. This indicates potential malicious activity where an attacker might be using these devices for command and control.
This rule detects attempts to flush auditd rules by looking for the command 'auditctl -D' within TCP traffic on port 22 (SSH). This action is often performed by attackers to remove monitoring and evade detection after gaining access to a system.
This rule detects the use of TCP port 5938, which is commonly associated with the TeamViewer protocol. The rule is specifically looking for established connections to this port, indicating potential remote command and control (C2) activity. A threshold is set to trigger an alert if three such connections are observed from the same source within 60 seconds, aiming to reduce noise from legitimate, infrequent TeamViewer usage while still catching suspicious patterns.
This rule detects the delivery of a payload via HTTP that contains the string "SetWindowsHookEx" (case-insensitive). This string is associated with a Windows API function used to install a hook procedure that monitors system events. Attackers often use this technique for persistence or to inject malicious code into other processes.
This rule detects HTTP PUT requests to Amazon S3 or Azure Blob Storage (cloud storage services) where the request body size is between 100 and 2000 bytes. This pattern is often indicative of one-way command and control (C2) communication, where an attacker might be exfiltrating small chunks of data or sending commands to a compromised host via cloud storage. The thresholding mechanism (20 events within 300 seconds from the same source) aims to reduce alerts from legitimate, infrequent cloud storage interactions.
This rule detects bidirectional Command and Control (C2) communication utilizing the Telegram Bot API. It specifically looks for HTTP traffic where the host is 'api.telegram.org' and the URI contains '/bot'. A threshold of 10 occurrences within 60 seconds from the same source IP is set to reduce false positives.
This rule detects when Azure Monitor Diagnostic Settings are deleted. It specifically looks for HTTP DELETE requests to 'management.azure.com' with 'diagnosticSettings' in the URI. This activity could indicate an attacker attempting to evade detection by removing logging configurations.
Page 106 of 211