Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,362 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects a potential Azure AD user account bulk enumeration attempt. It triggers when a source IP makes 20 or more HTTP requests within 30 seconds to 'graph.microsoft.com' with the URI containing '/users'. This pattern is indicative of an attacker attempting to enumerate multiple user accounts in Azure AD.
This rule detects attempts to enumerate domain group membership via LDAP queries. It specifically looks for TCP traffic to port 389 (LDAP) containing the string "(objectClass=group)" in a case-insensitive manner. A threshold is applied to trigger an alert if 10 such queries are observed from the same source within a 30-second window, indicating a potential network scan or reconnaissance activity.
This rule detects attempts to enumerate permission group memberships remotely over the Server Message Block (SMB) protocol, specifically targeting port 445. The detection is based on the presence of the case-insensitive string "NetGroupEnum" within the TCP payload, indicating a network scan or reconnaissance activity aimed at discovering group information.
This rule detects attempts to enumerate network connection tables remotely over SMB (port 445). It specifically looks for the string "NetConnectionEnum" in TCP traffic directed to port 445 on the home network, indicating a potential network discovery activity.
This rule detects HTTP requests to 'portal.azure.com', indicating access to the Azure management portal. A threshold is set to trigger an alert if 10 such requests are observed from the same source IP within 60 seconds. This activity is classified as a network scan, potentially for infrastructure discovery.
This rule detects attempts to enumerate installed software on a Windows machine via Remote WMI (Windows Management Instrumentation) over SMB (Server Message Block) on port 445. Specifically, it looks for the string "Win32_Product" within TCP traffic destined for port 445, indicating a WMI query for installed products. A threshold of 5 occurrences within 30 seconds from the same source is set to reduce false positives.
This rule detects attempts to access browser history files, specifically Google Chrome's history, over Server Message Block (SMB) protocol. The detection is triggered when SMB traffic contains the string "History" and "AppData\Local\Google\Chrome" (case-insensitive), indicating a potential reconnaissance activity where an attacker might be trying to exfiltrate or analyze browser history.
This rule detects attempts to enumerate the VMware vSphere virtual machine inventory via the API. It specifically looks for HTTP POST requests to the '/sdk/vimService' URI with 'RetrieveProperties' in the client body, indicating a query for system properties, which can include VM inventory details. The detection is focused on network traffic to port 443 (HTTPS) within the home network.
This rule detects attempts to query AWS CloudTrail logs for activity discovery. Specifically, it looks for HTTP traffic to 'cloudtrail.amazonaws.com' with the URI containing 'LookupEvents'. This activity could indicate an attacker attempting to understand the environment or their own actions.
This rule detects network traffic (HTTP response) from a server to a client that contains both 'GetUserDefaultLCID' and 'ExitProcess' in the file data, case-insensitively. This combination of strings is indicative of malware attempting to evade sandboxes or target specific locales by checking the system's default locale identifier and then potentially exiting if the environment is not suitable. This behavior is often associated with trojan activity.
Page 133 of 211