Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,362 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects RDP login attempts from an external network to the internal network. It specifically looks for the RDP protocol header (0x03 0x00) on TCP port 3389. A threshold of 5 attempts within 60 seconds from the same source IP is set to reduce false positives.
This rule detects potential Command and Control (C2) communication utilizing DNS at the application layer. It specifically looks for DNS queries and triggers an alert if a single source IP performs more than 30 DNS queries within a 60-second window, indicating a high frequency of DNS activity that could be indicative of C2.
This rule detects attempts to access SNMP (Simple Network Management Protocol) services on the home network using the default community string 'public'. It specifically looks for the string 'public' within TCP traffic destined for port 161 (the standard SNMP port). A threshold of 5 attempts within 30 seconds from the same source IP will trigger an alert, indicating potential brute-force or reconnaissance activity against SNMP devices.
This rule detects HTTP responses where the 'Content-Type' header is 'application/json' and the response body contains both 'balance' and '0.00' (case-insensitive). This combination, especially in the context of a 'trojan-activity' classification, suggests a potential Man-in-the-Middle (MitM) attack manipulating financial or account balance data within a JSON response to show a zero balance.
This rule detects attempts to manipulate stored records within an MSSQL database. It specifically looks for TCP traffic directed to port 1433 (the default MSSQL port) containing the keywords "UPDATE" and "SET" (case-insensitive) in the flow to the server. A threshold of 50 occurrences within 30 seconds from the same source IP is set to trigger an alert, indicating potential bulk data modification.
This rule detects SSH connections to the internal network ($HOME_NET) on port 22. It specifically looks for the 'SSH-2.0' content in the TCP flow to the server. A threshold is set to trigger an alert if three such connections are observed from the same source within 60 seconds. The rule's message suggests it's intended to identify third-party SSH access potentially using a vendor key, implying an attempt to detect unauthorized or unusual SSH activity.
This rule detects attempts to manipulate database data on a remote MySQL server (port 3306) by identifying 'UPDATE' and 'SET' SQL commands within TCP traffic. It uses a threshold to alert on a high frequency of these commands from a single source, indicating potential malicious activity like data modification or integrity compromise.
This rule detects drive-by malicious iframe injection by looking for HTTP responses (flow:to_client) that contain an iframe tag, the 'display:none' style attribute, and a 'src=' attribute. This combination is often used by attackers to embed malicious content invisibly into legitimate websites, leading to drive-by downloads or other client-side attacks.
This rule detects a Deauthentication (Deauth) attack pattern, specifically targeting forced Wi-Fi reconnections. It triggers an alert when a high volume (50 or more) of TCP SYN packets are observed from a single source IP address within a 5-second window directed towards the home network. This pattern is indicative of an attacker attempting to flood a Wi-Fi network with deauthentication frames, forcing legitimate clients to disconnect and then reconnect, which can be exploited for various malicious purposes like capturing handshakes or facilitating man-in-the-middle attacks.
This rule detects potential malicious script injection from ad networks. It looks for HTTP responses (flow:to_client) that contain common ad-related terms in the HTTP referer header (ad., ads., advert., banner.) and also contain JavaScript code obfuscation techniques like 'eval(' and 'fromCharCode' within the file data. This combination suggests an ad network might be serving malicious JavaScript to clients.
Page 129 of 211