Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,362 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects a high volume of Real-time Transport Protocol (RTP) video stream traffic originating from the home network and destined for external servers. Specifically, it triggers an alert if more than 100 UDP packets with a data size greater than 1000 bytes are observed from a single source IP address within a 10-second window. This pattern could indicate unauthorized video streaming or data exfiltration.
This rule detects the upload of a potential screen recording file to a remote server over HTTP. It specifically looks for HTTP POST requests where the URI contains the string "video" (case-insensitive) and the file data contains the byte sequence "|00 00 00|" within the first 4 bytes, indicating a common video file header. Additionally, the file size must be greater than 500KB, which helps to filter out small, non-video files.
This rule detects the exfiltration of a webcam video stream over HTTP POST. It specifically looks for HTTP POST requests containing file data, where the data starts with the hexadecimal sequence '52 49 46 46' (which corresponds to 'RIFF', a common header for multimedia file formats like AVI and WAV) and has a size greater than 100,000 bytes. This combination suggests a large multimedia file, potentially a video, being uploaded.
This rule detects the creation of an email auto-forwarding rule within Microsoft Exchange via the Exchange Web Services (EWS) interface. It specifically looks for HTTP requests to the '/EWS/Exchange.asmx' endpoint containing the string 'ForwardToRecipients' in the client body, indicating an attempt to configure email forwarding.
This rule detects a high volume of HTTP requests to graph.microsoft.com with the URI containing '/messages', indicating a potential bulk download of emails from Office 365 via the Graph API. The threshold is set to 30 requests within 60 seconds from a single source IP.
This rule detects when a file with the ".pst" extension (Outlook Personal Storage Table file) is copied locally via the Server Message Block (SMB) protocol. This could indicate data exfiltration or unauthorized access to sensitive email archives.
This rule detects the creation of in-memory archives using the .NET Compression Library by inspecting HTTP client-bound data for the presence of both "System.IO.Compression" and "ZipArchive" strings. This combination suggests that a .NET application is creating a ZIP archive in memory, which could be indicative of data staging or exfiltration activities.
This rule detects potential data exfiltration attempts where data is archived using scripting libraries. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "zipfile", "ZipFile(", and "write(" in the file data, indicating the use of a scripting library to create and write to a zip archive. This combination suggests that a client is receiving or downloading an archived file that was likely created programmatically for exfiltration.
This rule detects the string "zip -e" within TCP traffic on port 22 (SSH). This string is commonly used to create password-protected zip archives, and its presence in an SSH session could indicate an attempt to prepare data for exfiltration, especially if combined with SSH's secure tunneling capabilities. The rule specifically looks for traffic flowing from the client to the server.
This rule detects HTTP requests that contain both '7z' and '-p' in the URI, which could indicate the use of 7zip or WinRAR to archive data with a password, potentially for exfiltration. The rule specifically looks for these strings in the URI of an HTTP request flowing from the internal network to an external server.
Page 131 of 211