Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,362 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to modify a user's logon script via remote registry access. Specifically, it looks for TCP traffic on port 445 (SMB/CIFS, often used for remote registry) where the content "UserInitMprLogonScript" is present, indicating an attempt to alter this specific registry key. This activity is often associated with persistence techniques used by attackers to maintain access to a system.
This rule detects the creation of a new Azure AD user account via the Microsoft Graph API. It specifically looks for HTTP POST requests to 'graph.microsoft.com' with the URI containing '/users'. This activity could indicate an attacker establishing persistence by creating new accounts in a compromised Azure AD environment.
This rule detects attempts to register a new device for MFA bypass persistence by monitoring HTTP POST requests to graph.microsoft.com with a URI containing 'authentication/methods'. This activity could indicate an attacker attempting to register their own device as a trusted device to bypass multi-factor authentication in an Office 365 environment.
This rule detects attempts to update system firmware from an unverified source. It specifically looks for HTTP traffic (flow:to_client,established) where the URI contains the string "firmware" (case-insensitive) and the file data contains the byte sequence "AA 55". This combination suggests a potential firmware update being delivered over HTTP, which could be malicious if the source is not legitimate.
This rule detects a TFTP (Trivial File Transfer Protocol) boot file request. Specifically, it looks for UDP traffic destined for port 69 (the standard TFTP port) on the home network, containing the byte sequence "|00 01|" at a depth of 2 bytes. This pattern is characteristic of a TFTP read request (opcode 1). The rule's message suggests this could indicate a possible bootkit delivery attempt, as TFTP is often used in network booting scenarios.
This rule detects a port knocking sequence on closed ports. It triggers an alert when four TCP SYN packets are observed from the same source IP address within a 5-second window, targeting any port on the home network. This behavior is indicative of an attacker attempting to perform port knocking to open a hidden port or service.
This rule detects the download of Visual Studio Code (VS Code) or other Integrated Development Environment (IDE) extensions from official marketplaces (marketplace.visualstudio.com or open-vsx.org) when the downloaded file has a .vsix or .crx extension. This could indicate an attempt to install a malicious extension.
Botnet C2 Panel Access Detected
Suricata
This rule detects potential access to a botnet command and control (C2) panel. It triggers when HTTP URI requests contain both 'panel' and 'bot' (case-insensitive) within the URI. A threshold of 5 such requests from the same source within 60 seconds is set to reduce false positives.
This rule detects HTTP traffic where the referer header contains domains commonly associated with advertising networks (doubleclick.net, adnxs.com, googlesyndication) and the URI contains file extensions typically used for executable or script files (exe, ps1, msi, hta, vbs). This combination suggests a malvertising redirect attempt leading to the download of malicious files.
This rule detects HTTP traffic where the host header contains a domain with at least 8 alphanumeric characters followed by a common top-level domain (.com, .net, .org), and the URI contains the string 'gate' (case-insensitive). This pattern is indicative of a hijacked legitimate domain being used for Command and Control (C2) communication.
Page 120 of 211