Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,363 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to download files that appear to be password hash lists or wordlists, often used for offline credential cracking. It specifically looks for HTTP URIs containing keywords like 'rockyou', 'passwords', 'wordlist', or 'hashlist' followed by '.txt', and only triggers if the downloaded file size is greater than 10,000 bytes. This activity is indicative of an attacker attempting to exfiltrate or acquire data for credential access.
This rule detects attempts to copy the NTDS.dit Active Directory database file over SMB (Server Message Block) to a server. The rule specifically looks for the string "ntds.dit" within TCP traffic destined for port 445 (SMB). This activity is highly suspicious as the NTDS.dit file contains critical Active Directory information, including hashed user credentials, and its exfiltration is a common technique used by attackers for credential dumping.
This rule detects attempts to dump the Security Account Manager (SAM) hive using the 'reg save' command over HTTP. Specifically, it looks for HTTP requests containing 'reg save' and 'HKLM\SAM' in the URI, indicating an attempt to extract credential information from a Windows system.
This rule detects attempts to harvest Group Policy Preferences (GPP) credentials from the SYSVOL share over SMB. It specifically looks for network traffic on port 445 (SMB) containing the strings "SYSVOL" and "Groups.xml" in a case-insensitive manner, indicating a potential attempt to access the file where GPP credentials might be stored.
This rule detects attempts to harvest private key files (with extensions like .key, .pem, .p12, .pfx, .pkcs12) via HTTP requests, often indicative of a web shell being used to exfiltrate sensitive cryptographic material from a compromised server. The detection is based on the URI of the HTTP request.
This rule detects attempts to read AutoLogon credentials from the Windows Registry over the network, specifically targeting SMB (port 445) traffic. It looks for the strings 'DefaultPassword' and 'Winlogon' in a case-insensitive manner within the TCP payload, indicating a potential attempt to extract stored credentials used for automatic login.
This rule detects attempts to access secrets stored in Google Cloud Platform (GCP) Secret Manager via its API. It specifically looks for HTTP traffic directed to 'secretmanager.googleapis.com' with a URI path containing '/versions/' and ':access', indicating an attempt to access a specific secret version.
This rule detects attempts to retrieve secret values from AWS Secrets Manager. It specifically looks for HTTP requests to 'secretsmanager.amazonaws.com' containing 'GetSecretValue' in the URI. This activity could indicate an attacker attempting to access sensitive credentials.
This rule detects the delivery of a Windows Credential Manager dump tool over HTTP. It specifically looks for the case-insensitive string "CredEnumerate" within the file data of an HTTP response flowing to the client. This string is indicative of tools designed to interact with or dump credentials from the Windows Credential Manager.
This rule detects attempts to access Kubernetes secret objects via the Kubernetes API. It specifically looks for HTTP requests to the '/api/v1/namespaces/' path followed by '/secrets' on port 8080. This activity could indicate an attacker attempting to exfiltrate sensitive information stored in Kubernetes secrets.
Page 108 of 211