Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,363 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects HTTP requests where the 'Host' header contains patterns indicative of free hosting services (000webhost, infinityfree, byethost). These services are often abused by attackers to host malicious infrastructure due to their low cost and ease of setup. The rule specifically looks for these patterns in HTTP traffic flowing from the home network to any destination.
This rule detects a pattern of bulk account registration attempts by monitoring HTTP POST requests to URIs containing 'register'. It triggers an alert if 10 such requests are observed from the same source IP within a 60-second window, indicating potential automated account creation or abuse.
This rule detects attempts to download malware builder tools (such as builders, generators, crypters, or packers) from raw.githubusercontent.com. It specifically looks for HTTP traffic where the host is 'raw.githubusercontent.com' and the URI contains keywords commonly associated with malware development tools.
This rule detects the download of files from raw.githubusercontent.com that contain keywords commonly associated with exploit frameworks, CVEs, or Proof-of-Concepts (PoCs). It specifically looks for 'exploit', 'cve-[0-9]{4}', or 'poc' within the HTTP URI. This activity could indicate an attacker downloading tools or modules for exploitation during resource development or initial access phases.
This rule detects the installation of a new self-signed TLS certificate that might be used by a Command and Control (C2) server. It specifically looks for TLS certificates where both the issuer and subject Common Name (CN) are at least 5 alphanumeric characters long and the 'not before' date is in the current or future years (2024-2029). This combination of characteristics can indicate a newly generated, potentially malicious self-signed certificate.
This rule detects HTTP responses that appear to be phishing pages designed to capture credentials. It specifically looks for HTTP traffic flowing to the client that contains both the words "password" and "submit" (case-insensitive) in the file data, and where the HTTP host is an IP address. This combination suggests a credential input form on a page served from an IP address, which is a common characteristic of phishing attempts.
Offshore VPS Provider API Access
Suricata
This rule detects HTTP traffic to specific domains associated with offshore VPS providers (frantech.ca, serverius.net, combahton.net). This could indicate API access or other interactions with these services, which might be suspicious depending on the environment.
This rule detects potential VPN gateway fingerprinting attempts via the Internet Key Exchange (IKE) protocol. It triggers an alert when a source IP sends 5 or more UDP packets to port 500 (the standard IKE port) on the home network within a 30-second window. This behavior can indicate an attacker attempting to identify active VPN services or their configurations.
This rule detects a network scan targeting TCP port 4444 on the home network. It specifically looks for SYN packets (flags:S) indicating an attempt to establish a connection. A threshold of 5 connection attempts from the same source within 60 seconds triggers the alert, suggesting a port scan activity. Port 4444 is often associated with security appliance management interfaces or backdoors, making probes to this port suspicious.
This rule detects HTTP requests to known IP geolocation lookup services (ip-api.com, ipinfo.io, ipgeolocation.io). A high frequency of such requests from a single source IP within a short timeframe (10 requests in 60 seconds) could indicate reconnaissance activity, where an attacker is gathering information about target IP addresses.
Page 111 of 211