Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,363 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects the delivery of a JavaScript payload that has been hex encoded. It specifically looks for the hex representation of the string "script" (\x73\x63\x72\x69\x70\x74) within HTTP response data flowing to the client. This technique is often used by attackers to obfuscate malicious JavaScript code and evade signature-based detection.
This rule detects attempts to delete files or directories using the 'rm -rf' command within a web request URI. This often indicates an attacker attempting to clean up traces of their activity or cause denial of service by removing critical files on a compromised web server.
This rule detects attempts to delete files on a web server using a web shell. It specifically looks for the 'unlink' command within HTTP URI requests, indicating a potential file deletion operation initiated through a compromised web application.
This rule detects attempts to exploit the Zerologon (CVE-2020-1472) vulnerability, a critical privilege escalation flaw in Microsoft's Netlogon Remote Protocol. It specifically looks for network traffic on TCP port 445 (SMB) containing the 'NetrServerAuthenticate3' function call with a specific sequence of null bytes, which is indicative of an unauthenticated Netlogon session setup without signing and sealing, a key characteristic of the Zerologon exploit.
This rule detects attempts to remotely install Windows services over Server Message Block (SMB). It specifically looks for network traffic on port 445 (SMB) containing the strings "svcctl" and "CreateService" in a case-insensitive manner, indicating a service control request to create a new service. This activity is often associated with adversaries establishing persistence on a compromised system.
This rule detects attempts to enumerate USB devices on a system via a web shell. It specifically looks for HTTP URI requests containing 'wmic' and 'path Win32_USBHub', which are commands used to query USB device information using Windows Management Instrumentation (WMI). The 'nocase' modifier indicates that the content matching is case-insensitive.
This rule detects NTP amplification DDoS attacks by looking for UDP traffic on port 123 (NTP) with a specific content signature ('|17 00 03 2a|') and a high threshold of 50 packets within 5 seconds from the same destination. This pattern is indicative of an NTP monlist request, which can be abused for amplification attacks.
This rule detects HTTP requests to a server that contain both 'password' and 'username' in the URI, case-insensitively. This pattern is indicative of a potential credential harvesting attempt where an attacker is trying to collect user credentials via a crafted web page or phishing site. The rule specifically looks for these keywords in the URI of an established HTTP connection flowing to the server.
This rule detects Kerberoasting activity, specifically looking for multiple Kerberos Ticket Granting Service (TGS) requests over UDP port 88 within a short timeframe from the same source IP. Kerberoasting is a post-exploitation technique used by attackers to obtain service principal name (SPN) hashes, which can then be cracked offline to retrieve the associated plaintext passwords. The rule uses a threshold of 20 TGS requests within 10 seconds from a single source to identify this suspicious behavior.
This rule detects the delivery of a kernel exploit via HTTP. It specifically looks for HTTP responses (flow:to_client) containing a file with the 'MZ' header (indicating a Windows executable) and the string 'exploit' (case-insensitive) in the HTTP URI. This combination suggests an attempt to deliver a malicious executable, potentially a kernel exploit, to a client system.
Page 113 of 211