Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,362 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Detects modification of registry keys that trigger event-based execution for persistence
Detects logon scripts dropped to NETLOGON or SYSVOL for domain-wide execution
Detects unauthenticated access to Docker daemon API for container escape
Detects remote modification of file and directory permissions via SMB
Detects creation of email auto-forwarding rules for persistent email collection
Detects signed Windows binaries abused as execution proxies for defense evasion
Detects download of known offensive security tools for capability acquisition
Detects malware using debugger detection APIs to evade dynamic analysis
Detects high-volume RPC endpoint mapper requests indicating inter-process communication abuse
This rule detects the execution of a VDSO hijacking payload over an SSH connection. It specifically looks for the case-insensitive strings "vdso" and "mmap" within the TCP payload of an established SSH session, indicating an attempt to manipulate the Virtual Dynamic Shared Object (VDSO) for privilege escalation or other malicious purposes.
Page 118 of 211