Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,362 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects HTTP POST requests to pastebin.com's API for pasting content, specifically targeting the '/api/api_paste.php' endpoint. It triggers if the size of the data being uploaded is greater than 1000 bytes, indicating a potential data exfiltration attempt to a public text storage site.
This rule detects potential data exfiltration to Dropbox cloud storage. It specifically looks for HTTP POST requests to 'api.dropboxapi.com' with a data size greater than 10000 bytes. This indicates a significant amount of data being uploaded to Dropbox, which could be a sign of unauthorized data transfer.
This rule detects potential sensitive data exfiltration to a web service. It triggers when an HTTP POST request is made from the home network to any destination, and the request body size is greater than 10,000 bytes. A threshold is applied, alerting if 10 such events occur from the same source IP within 60 seconds. This pattern suggests a large amount of data being uploaded, which could indicate exfiltration.
This rule detects bulk file copies to USB drives via SMB by looking for the string "USBSTOR" (case-insensitive) within SMB traffic on port 445. A threshold of 100 occurrences within 60 seconds from the same source IP triggers the alert, indicating a potential exfiltration attempt.
This rule detects HTTP POST requests from the home network to any external server where the request body size is greater than 10000 bytes. It uses a threshold to alert if 5 such events occur from the same source IP within an hour, indicating a potential cron-timed data upload or exfiltration attempt.
This rule detects attempts to deface a web server's homepage by replacing its content. It specifically looks for HTTP PUT requests targeting a URI containing "index" (case-insensitive), indicating an attempt to modify an index file. The rule also checks the size of the data being sent in the PUT request, looking for a size between 500 and 5000 bytes, which could indicate the insertion of defacement content.
This rule detects attempts to deface web server content by using an HTTP PUT request to modify files with extensions such as .html, .htm, .php, .asp, or .aspx. It specifically looks for HTTP PUT methods targeting these file types on an internal web server.
This rule detects attempts to set or modify an S3 bucket lifecycle policy for auto-deletion. It specifically looks for HTTP PUT requests to 's3.amazonaws.com' with a URI containing '?lifecycle'. This activity could indicate an attacker attempting to delete data after exfiltration or to destroy evidence.
This rule detects the execution of a system shutdown command ('shutdown -h now') over an SSH connection. It specifically looks for this string within TCP traffic directed to port 22 (SSH) on the home network, indicating a remote shutdown initiated via SSH.
This rule detects attempts to initiate a remote system shutdown via the Server Message Block (SMB) protocol. It specifically looks for the string "InitiateSystemShutdown" within TCP traffic directed to port 445 (SMB) on the home network. This activity is often associated with malicious behavior, such as ransomware or destructive attacks, aiming to disrupt systems.
Page 128 of 211