Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,362 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects the delivery of an Application Shim Database (.sdb file) over HTTP. Application Shims are used by Windows to ensure compatibility with older applications, but can also be abused by attackers for persistence and privilege escalation (e.g., by shimming malicious DLLs). Detecting the transfer of these files, especially over unencrypted HTTP, can indicate suspicious activity related to T1546.011 (Application Shimming).
This rule detects a brute-force attack against an SSH service on a network device management port. It triggers an alert if 15 or more TCP SYN packets are observed from a single source IP address to destination port 22 (SSH) within a 30-second window, indicating an attempt to establish multiple connections, characteristic of a brute-force attempt.
This rule detects attempts to register a Netsh helper DLL for persistence. Netsh (Network Shell) is a command-line scripting utility that allows you to display or modify the network configuration of a locally running computer. Attackers can abuse the 'add helper' command to register a malicious DLL, which will then be loaded by Netsh whenever it runs, providing a persistence mechanism. The rule specifically looks for TCP traffic on port 445 (SMB) containing the strings "netsh" and "add helper" in a case-insensitive manner, indicating an attempt to use this technique.
This rule detects the use of the 'trap' command with 'EXIT' in TCP traffic, which is a common technique used for persistence on Unix-like systems. Attackers can use the 'trap' command to execute arbitrary commands when a shell exits, ensuring their malicious code runs even after a session is closed.
This rule detects bulk email account creation attempts on free email providers ProtonMail and Tutanota. It triggers when a client makes 3 or more HTTP requests within 60 seconds to the signup page of either protonmail.com or tutanota.com.
This rule detects attempts to create a new container service via the Docker API. It specifically looks for HTTP POST requests to the '/services/create' URI on port 2375, which is the default unencrypted Docker API port. This activity could indicate an attacker attempting to establish persistence or execute malicious containers on a compromised Docker host.
This rule detects the delivery of a macOS Launch Daemon Property List (.plist) file via HTTP. Attackers often use Launch Daemons for persistence on macOS systems. The rule specifically looks for HTTP traffic containing '.plist' in the URI and 'LaunchDaemon' within the file data, indicating a potential attempt to establish persistence.
This rule detects the download of potential malware source code by inspecting HTTP URI paths and file data. It triggers if the HTTP URI contains keywords like 'rat', 'trojan', 'keylogger', 'ransomware', or 'botnet' (case-insensitive) and the downloaded file data contains the string 'import socket' (case-insensitive). This combination suggests the download of Python-based malware source code.
This rule detects when a TFTP (Trivial File Transfer Protocol) boot image is potentially pushed to a network device. It specifically looks for UDP traffic on port 69 (TFTP default port) directed to the home network, containing the byte sequence "|00 02|" (which often indicates a TFTP write request or a specific TFTP opcode) and having a data size greater than 10000 bytes, suggesting a large file transfer like a boot image.
Dual-Use Hacking Tool Download
Suricata
This rule detects the download of dual-use hacking tools by inspecting HTTP URI paths for keywords like 'nmap', 'metasploit', 'cobaltstrike', 'empire', 'covenant', and 'sliver'. It specifically looks for these keywords in a case-insensitive manner within the HTTP URI, indicating a potential attempt to download tools that can be used for both legitimate security testing and malicious activities.
Page 121 of 211