Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,363 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects network traffic destined for TCP port 902 on the home network, which is commonly used for ESXi vSphere management. The rule specifically looks for established TCP connections to this port and triggers an alert if five such connections are observed from the same source within a 30-second window. This could indicate management activity or potential reconnaissance/attack against ESXi hosts.
This rule detects the writing of an 'autorun.inf' file to a Server Message Block (SMB) share, specifically targeting removable media shares. The presence of 'autorun.inf' on removable media is often associated with malware attempting to auto-execute when the media is inserted into a Windows system.
This rule detects network traffic indicative of a domain account being used for lateral movement via SMB. It specifically looks for NTLMSSP authentication within SMB traffic directed to port 445 on the home network, containing the string 'domain' (case-insensitive). A threshold of 10 occurrences within 60 seconds from the same source IP triggers the alert, suggesting a potential brute-force or rapid access attempt.
This rule detects the delivery of potentially malicious Flash (.swf) or Java (.jar, .class) files over HTTP. It specifically looks for HTTP responses where the URI ends with one of these extensions and the file data begins with 'MZ', which is the magic number for Windows executable files. This combination suggests an attempt to disguise an executable as a Flash or Java file, likely for exploit delivery.
This rule detects potential browser exploit delivery via heap spray techniques. It specifically looks for a sequence of 12 NOP (No Operation) instructions (0x90) in HTTP response data flowing to a client. This pattern is commonly used in heap spray attacks to prepare memory for shellcode execution.
This rule detects potential rogue DHCP servers on a wireless segment by looking for UDP traffic on port 67 (DHCP server port) with a specific DHCP message type (likely a DHCP offer or acknowledgement, indicated by '|02|' at offset 0). It uses a thresholding mechanism to trigger an alert if 3 such packets are observed from the same source within 10 seconds, which helps to reduce false positives from single, isolated packets.
This rule detects the presence of the string 'document.write(unescape(' in HTTP response bodies. This pattern is commonly used in web-based attacks to inject malicious content, often obfuscated, into legitimate web pages served to clients. The 'flow:to_client,established' indicates that the rule is looking at traffic flowing from the server to the client over an established connection, specifically within the HTTP data payload ('file.data'). The 'nocase' option ensures the detection is case-insensitive.
This rule detects HTTP traffic to 'teams.microsoft.com' with a URI containing '/messages/'. It is designed to identify potential social engineering attempts where malicious links are delivered via Microsoft Teams messages. The rule uses a threshold of 5 occurrences within 60 seconds from the same source IP to reduce false positives.
This rule detects network connections from devices that might be Raspberry Pis or Hak5 devices, based on their HTTP User-Agent string. Specifically, it looks for User-Agents containing 'python-requests' or 'curl/' followed by a digit, indicating the use of common command-line tools or Python libraries for making HTTP requests. The rule is configured to trigger an alert if 10 such connections are observed from the same source IP within 10 seconds, suggesting automated or frequent activity.
This rule detects DHCP requests originating from a MAC address that is not recognized or expected within the network. It uses a threshold to prevent excessive alerts from a single source, triggering if a source makes more than one DHCP request within a 5-second window. This could indicate an unauthorized device attempting to join the network or a spoofed MAC address.
Page 110 of 211