Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,362 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects potential Process Doppelganging attempts by looking for specific Windows API calls related to Transactional NTFS (TxF) within HTTP traffic. Specifically, it looks for the presence of "NtCreateTransaction" and "NtCreateSection" in the file data of HTTP responses, indicating a payload that might be attempting to leverage TxF for process creation manipulation.
This rule detects potential process hollowing activity by looking for specific strings in HTTP client-to-server traffic. It triggers if the traffic contains both 'CREATE_SUSPENDED' and 'NtUnmapViewOfSection' (case-insensitive). These strings are indicative of a technique where a legitimate process is created in a suspended state, its memory unmapped, and then malicious code is injected and executed.
This rule detects the presence of a TLS Callback Injection payload in HTTP traffic flowing from the server to the client. It specifically looks for the case-insensitive strings "TlsCallback" and "IMAGE_TLS_DIRECTORY" within the file data of the HTTP response. This technique is often used by malware to achieve code injection and execution.
This rule detects attempts to abuse the macOS AuthorizationExecuteWithPrivileges function, which allows an application to execute a command with root privileges. The detection is based on the presence of the string "AuthorizationExecuteWithPrivileges" in HTTP response data, indicating a potential attempt by malware or an attacker to escalate privileges on a macOS system.
This rule detects potential PE injection payloads over HTTP by looking for the presence of both "NtUnmapViewOfSection" and "VirtualAllocEx" in the file data. These API calls are commonly used in process injection techniques, specifically for unmapping legitimate sections of a process and allocating new memory for malicious code.
This rule detects the delivery of a payload designed to bypass macOS Transparency, Consent, and Control (TCC) mechanisms via HTTP. Specifically, it looks for the string "kTCCServiceCamera" within HTTP response data, indicating an attempt to manipulate camera access permissions. This activity is often associated with privilege escalation techniques on macOS.
This rule detects network traffic containing the string "/etc/sudoers" over TCP port 22 (SSH). This could indicate an attempt to modify the sudoers file for privilege escalation, as the sudoers file controls which users can execute commands with superuser privileges.
This rule detects attempts to manipulate the sudo timestamp cache by looking for repeated 'sudo -n' commands within a short timeframe. The 'sudo -n' command allows sudo to run a command without prompting for a password, which can be abused by an attacker to maintain sudo privileges or bypass re-authentication if they have already compromised a user's session. The thresholding mechanism (10 times in 30 seconds from the same source IP) aims to reduce false positives from legitimate, infrequent uses of 'sudo -n' and focus on potential automated or rapid attempts to interact with sudo without password prompts, possibly to keep the timestamp alive or to quickly execute multiple commands.
This rule detects the delivery of a tool designed to bypass User Account Control (UAC) via HTTP. It specifically looks for HTTP responses containing the strings "IsUserAnAdmin" and "ShellExecute" (case-insensitive) within the file data, indicating the presence of code commonly used in UAC bypass techniques.
This rule detects potential Kerberos authentication abuse related to cross-domain trusts. It specifically looks for TCP traffic on port 88 (Kerberos) to the home network, containing the byte '6b' at the first position of the payload. A threshold of 20 occurrences within 10 seconds from the same source IP is set to trigger an alert, indicating a potential brute-force or rapid authentication attempt.
Page 119 of 211