Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,362 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects potential Remote Access Trojan (RAT) callbacks occurring after a remote support session. It specifically looks for HTTP GET requests where the URI contains keywords like 'setup', 'install', 'support', or 'remote' (case-insensitive) and the User-Agent header contains 'MSIE'. This combination suggests a possible RAT communicating with its command and control server, masquerading as legitimate remote support or installation traffic.
This rule detects potential credential phishing attempts by identifying HTTP responses (flow:to_client,established) that contain common keywords associated with login pages, specifically 'password', 'username', and 'action='. The rule looks for these keywords within the file data of the HTTP response, indicating a web page being served to the client that mimics a login form.
This rule detects HTTP requests made to 'search.censys.io', indicating a query to the Censys Internet Asset Database. This activity is often associated with reconnaissance efforts, where an attacker or security researcher gathers information about internet-facing assets.
This rule detects WMI DCOM port reconnaissance activity targeting the Endpoint Mapper service on port 135. It triggers an alert when a source IP initiates 10 or more TCP SYN packets to port 135 on the HOME_NET within a 30-second window, indicating a potential network scan.
This rule detects exploitation attempts targeting the Spring4Shell vulnerability (CVE-2022-22965). It specifically looks for HTTP requests containing the string "class.module.classLoader" in the URI, which is a known indicator of this RCE exploitation attempt.
This rule detects DNS TXT record responses containing a Base64 encoded payload of at least 60 characters. This pattern is often used by malware for command and control (C2) communication or data exfiltration, leveraging DNS tunneling to evade detection.
This rule detects attempts to exploit a Local File Inclusion (LFI) vulnerability to read the `/etc/passwd` file on a web server. It specifically looks for HTTP requests where the URI contains the string `/etc/passwd`.
This rule detects Kerberos Pass-the-Ticket attacks where a Ticket Granting Service (TGS) request contains a forged Privilege Attribute Certificate (PAC). This is identified by specific byte sequences in UDP traffic on port 88, which is commonly used for Kerberos.
This rule detects an attempted pre-authentication Remote Code Execution (RCE) exploit against the Remote Desktop Protocol (RDP) service, commonly known as 'BlueKeep'. It specifically looks for a sequence of bytes within the RDP traffic on port 3389, indicating a potential exploit attempt.
This rule detects attempts to remotely shut down a system using the Server Message Block (SMB) protocol. It specifically looks for the string "InitiateSystemShutdown" within TCP traffic destined for port 445 (SMB). This activity can be indicative of an attacker attempting to disrupt services or systems.
Page 125 of 211