Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,362 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects network host discovery attempts using a TCP SYN sweep. It triggers when a source IP sends 30 or more TCP SYN packets (indicated by the 'flags:S' option) to any destination on the HOME_NET within a 10-second window. This behavior is characteristic of an attacker attempting to identify active hosts on a network by sending SYN packets and observing which hosts respond with a SYN-ACK.
This rule detects HTTP requests to github.com that contain sensitive file names or patterns in the URI, such as '.env', 'config.php', 'credentials', 'secrets', or 'api_key'. This activity could indicate an attacker or malicious actor searching for sensitive information exposed in public or private GitHub repositories.
This rule detects attempts to fingerprint WordPress login pages by monitoring HTTP requests for the 'wp-login.php' URI. It triggers an alert if a source IP makes 5 such requests within 60 seconds, indicating a potential reconnaissance activity against WordPress installations.
This rule detects network traffic generated by the OpenVAS vulnerability scanner. It specifically looks for HTTP requests where the User-Agent header contains the string "OpenVAS" (case-insensitive). This indicates that an OpenVAS scanner is actively probing the network, which could be part of a legitimate security assessment or a malicious reconnaissance effort.
Stealth NULL Scan Port Probe
Suricata
This rule detects a Stealth NULL Scan Port Probe. A NULL scan is a type of port scan where all the TCP flags (URG, ACK, PSH, RST, SYN, FIN) are turned off. If the target port is closed, the target system should respond with an RST packet. If the port is open, the target system should not respond at all. This behavior can be used by attackers to map out open ports on a system while attempting to evade detection by some firewalls or intrusion detection systems that might be configured to only look for SYN packets.
This rule detects potential credential phishing attempts by identifying HTTP URIs that contain the keywords 'redirect', 'login', and 'microsoft' (case-insensitive). This combination of keywords in a URI is often indicative of a phishing link designed to trick users into providing credentials, especially targeting Microsoft accounts, by redirecting them to a fake login page.
This rule detects potential adversary-in-the-middle (AiTM) phishing attempts, specifically those leveraging tools like Evilginx. It triggers on HTTP requests where the URI contains the keywords "verify", "session", and "token" (case-insensitive). This combination of keywords in the URI is indicative of phishing pages designed to capture session tokens or verification codes.
This rule detects HTTP responses containing a PDF file that also includes the string "/URI" and "login" (case-insensitive). This combination is indicative of a malicious PDF credential phishing page being served to a client. The rule specifically looks for the PDF magic bytes at the beginning of the file data.
This rule detects suspicious HTTP traffic indicating a LinkedIn message that contains an external link. It specifically looks for HTTP requests to 'linkedin.com' with a URI containing '/messaging/' and triggers if 10 such events occur within 60 seconds from the same source IP address. This pattern is often associated with social engineering attempts where attackers use LinkedIn messaging to direct users to malicious external sites.
This rule detects potential organization information harvesting via web scraping. It triggers when a client makes 25 or more HTTP GET requests to URIs containing the string "about" (case-insensitive) within a 20-second window. This behavior could indicate an automated script or tool attempting to gather information from a website's 'about us' or similar pages.
Page 112 of 211