Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,362 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects the delivery of a Windows Dynamic Link Library (DLL) file via HTTP that could be used for execution flow hijacking. It specifically looks for HTTP responses containing a URI with '.dll', the 'MZ' magic bytes at the beginning of the file data, and a file size greater than 10,000 bytes, indicating a potentially legitimate or malicious DLL being downloaded to a client.
This rule detects attempts to plant a DLL file in an application's 'Program Files' directory over SMB. This is a common technique used in DLL hijacking attacks, where a malicious DLL is placed in a location where a legitimate application will load it instead of the intended system DLL. The rule specifically looks for SMB traffic to port 445, containing '.dll' and '\Program Files\' in a case-insensitive manner, indicating a file transfer to a sensitive application directory.
This rule detects network traffic on TCP port 445 (SMB) containing the strings "system32" and "msv1_0.dll" in a case-insensitive manner. This pattern is indicative of an attempt to replace the authentication DLL (msv1_0.dll) on a remote Windows host, which is a known technique for persistence and credential manipulation.
This rule detects attempts to modify authentication configuration via LDAP by looking for the string "msDS-SupportedEncryptionTypes" in TCP traffic destined for port 389 (LDAP). This string is associated with changes to supported encryption types in Active Directory, which could be an indicator of persistence or privilege escalation.
This rule detects attempts to add an autostart entry via a remote registry write operation targeting TCP port 445 (SMB). It specifically looks for network traffic containing the strings "Run", "HKCU" (HKEY_CURRENT_USER), and "\Software\Microsoft\Windows", indicating a modification to the current user's run keys for persistence. This activity is often associated with malware or adversaries establishing persistence on a compromised Windows system.
This rule detects HTTP requests made to 'whois.domaintools.com', indicating a WHOIS domain lookup activity via a web service. It triggers an alert if five such requests are observed from the same source within 60 seconds. This activity is often associated with reconnaissance.
This rule detects potential subdomain enumeration activity by identifying a high volume of DNS queries (100 queries within 30 seconds) originating from a single source IP address to port 53 (DNS) on the home network. This behavior is indicative of an attacker attempting to discover subdomains of a target domain.
This rule detects attempts to use search engine filetype dorking techniques to discover sensitive files. It specifically looks for HTTP requests containing the string "filetype:" in the URI, which is a common operator used in search engines to filter results by file extension. This activity is often associated with reconnaissance efforts by attackers to find publicly exposed documents, spreadsheets, or other files that might contain sensitive information.
This rule detects attempts to fingerprint the version of a Drupal Content Management System (CMS) by requesting the 'CHANGELOG.txt' file. This file often contains version information and is a common target for attackers performing reconnaissance to identify potential vulnerabilities.
Stealth FIN Scan Port Probe
Suricata
This rule detects a stealth FIN scan port probe. A FIN scan is a type of port scan that sends TCP segments with only the FIN flag set. If the target port is closed, it should respond with an RST segment. If the port is open, it should ignore the FIN segment. This rule triggers if 10 such FIN packets are observed from a single source within a 30-second window, indicating a potential port scan attempt.
Page 124 of 211