Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,362 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects RDP access attempts from external IP addresses to the internal network ($HOME_NET) on port 3389. It uses a threshold of 3 connection attempts within 300 seconds from the same source IP to trigger an alert, indicating potential brute-force or reconnaissance activity targeting RDP services. The rule is classified under the MITRE ATT&CK technique T1133, which involves 'Remote Desktop Protocol' for initial access.
This rule detects the download of a Microsoft Office document that is macro-enabled. It specifically looks for HTTP traffic flowing to the client (download) that contains both "[Content_Types].xml" and "vbaProject" within the file data. These strings are indicative of an Office Open XML (OOXML) file (like .docx, .xlsx, .pptx) that contains VBA macros, which are often used in phishing attacks for initial access.
This rule detects web directory brute-force attempts by identifying HTTP requests where the User-Agent header contains the string "DirBuster". DirBuster is a well-known tool used for brute-forcing directories and file names on web servers.
This rule detects web directory brute-force attempts by identifying the 'gobuster' string in the HTTP User-Agent header. Gobuster is a common tool used for directory and file enumeration on web servers, often as part of reconnaissance or vulnerability scanning activities. The rule specifically targets HTTP traffic flowing to the server.
Cron Job Injection via Web Shell
Suricata
This rule detects attempts to inject cron job commands via web shell activity. It specifically looks for HTTP requests where the URI contains the case-insensitive string "crontab", indicating an attempt to modify scheduled tasks on a system through a web interface, likely a compromised web shell.
Remote AT Job Scheduled via SMB
Suricata
This rule detects attempts to schedule a remote AT job via SMB. It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, containing the case-insensitive strings "atsvc" and "JobAdd". This combination indicates an attempt to use the AT service to add a scheduled task remotely, which can be a method for persistence or execution by attackers.
This rule detects the download of a compiled AutoIT script payload over HTTP. It specifically looks for the 'AU3!' magic bytes at the beginning of the file data, which is characteristic of compiled AutoIT executables. The detection is focused on traffic flowing from the server to the client (to_client) and assumes an established connection.
This rule detects potential AWS CLI API command execution by monitoring HTTP traffic for connections to 'amazonaws.com' and the presence of 'Action=' in the URI. It uses a threshold of 30 occurrences within 10 seconds from a single source IP to reduce false positives, indicating a high volume of API calls typical of automated scripts or tools.
This rule detects attempts to access the command-line interface (CLI) of a network device via Telnet, specifically looking for the 'enable' and 'configure terminal' commands. This indicates an administrative attempt to configure or manage a network device.
This rule detects HTTP responses that contain specific keywords indicative of a fake CAPTCHA paste attack page. It looks for the terms "CAPTCHA", "paste", and "Win+R" (case-insensitive) within the HTTP response body. This combination suggests a social engineering attempt where users are tricked into pasting malicious content, often after being instructed to open the 'Run' dialog (Win+R).
Page 126 of 211