Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,362 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects a high volume of HTTP GET requests to storage.googleapis.com, indicating a potential bulk download of objects from Google Cloud Storage. The threshold is set to 50 requests within 60 seconds from a single source IP address.
This rule detects potential bulk export of customer data from CRM applications like Salesforce, HubSpot, or Dynamics. It triggers when HTTP requests to these services contain 'export' in the URI, indicating a data export operation. A threshold of 5 such requests within 60 seconds from the same source IP is set to identify bulk activity.
This rule detects a high volume of TCP SYN packets from an external IP address to the internal network, indicative of an attempted remote service access or port scan. Specifically, it triggers if 5 or more TCP SYN packets are observed from the same source IP within a 30-second window, targeting any port on the home network.
This rule detects attempts to list active network connections using the 'netstat' command via a web shell. It specifically looks for HTTP requests where the URI contains the case-insensitive string 'netstat'. This activity is indicative of an attacker trying to gain reconnaissance on the compromised system's network connections.
This rule detects attempts to enumerate Wi-Fi network profiles by looking for the command 'netsh wlan show' within HTTP URI requests. This activity is often associated with web shell usage, where an attacker has gained remote access to a web server and is using it to gather information about the underlying system's network configuration.
This rule detects attempts by a client on the home network to check internet connectivity by querying external IP lookup services over HTTP. It specifically looks for requests to domains like api.ipify.org, ifconfig.me, checkip.amazonaws.com, and icanhazip.com. A threshold is set to trigger an alert if five such requests are observed from the same source within 30 seconds, indicating a potential network scan or reconnaissance activity.
This rule detects attempts to enumerate services on a system using the 'sc query' command, typically executed via a web shell. The detection is based on the presence of 'sc query' within the HTTP URI, indicating a command injection attempt through a web application.
This rule detects attempts to query the domain password policy over SMB by looking for the 'NetUserModalsGet' content within TCP traffic on port 445. This activity is often associated with reconnaissance or discovery phases by attackers to understand password complexity requirements.
This rule detects attempts to enumerate password policy information, specifically the 'pwdHistoryLength' attribute, from a domain controller via an LDAP query. It looks for TCP traffic on port 389 (LDAP) where the client sends a query containing both '(objectClass=domain)' and 'pwdHistoryLength' in a case-insensitive manner.
This rule detects attempts to query the system time using the 'net time' command via a web shell. It specifically looks for the string 'net time' within the HTTP URI of traffic flowing to the server. This activity is indicative of an attacker using a web shell to gather information about the compromised system, specifically its time synchronization status or current time.
Page 132 of 211