Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,362 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects potential lateral movement attempts using alternate authentication material, specifically NTLMSSP, over SMB (port 445). It triggers an alert if five or more NTLMSSP authentications are observed from a single source IP address to the home network within a 30-second window. This behavior can indicate an attacker attempting to authenticate to multiple systems using stolen credentials or hashes.
This rule detects HTTP traffic where the URI contains both 'schtasks' and '/delay' (case-insensitive). This combination suggests an attempt to create a scheduled task with a delayed execution, which can be used by adversaries for sandbox evasion or persistence.
This rule detects the delivery of source code files (C, C++, C#, Java, Go, Rust) over HTTP to a client, specifically looking for content that includes 'main(' within the file data. This pattern suggests that a source code payload intended for compilation after delivery is being transferred, which could be indicative of malicious activity such as a staged attack where the attacker compiles and executes code on the victim's machine.
This rule detects potential sandbox evasion techniques by identifying HTTP responses containing a 'Sleep(' function call with a duration of 1,000,000 milliseconds (1000 seconds) or more. This long sleep duration is often used by malware to delay execution and bypass time-based sandboxes, which typically have limited execution times for analysis.
This rule detects the delivery of a raw volume access tool via HTTP. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "CreateFile", "\\.\", and "GENERIC_READ" within the file data. These strings are indicative of an application attempting to open a raw volume device for direct read access, often a technique used by malware or forensic tools to bypass file system controls.
This rule detects attempts to access physical drives directly over SMB by looking for the string "\\.\PhysicalDrive" in TCP traffic on port 445. This technique can be used by attackers to bypass file system access controls and directly read or write to disk sectors, often as part of defense evasion or data exfiltration.
This rule detects the potential reuse of an OAuth Bearer token from different IP addresses. It monitors HTTP traffic for the 'Authorization: Bearer' header and triggers an alert if the same token is observed from more than 20 distinct destination IP addresses within a 10-second window. This behavior can indicate an attempt to bypass authentication or session management, potentially through token theft or replay.
This rule detects HTML smuggling attempts by identifying the 'msSaveOrOpenBlob' API call within HTTP response bodies. This API is often used by attackers to deliver malicious files directly to a user's browser, bypassing traditional network security controls. The rule specifically looks for the case-insensitive string 'msSaveOrOpenBlob' in the file data of HTTP responses flowing from the server to the client.
This rule detects network traffic containing the strings "bcdedit" and "safeboot" over TCP port 445 (SMB). This combination suggests an attempt to remotely configure a system to boot into safe mode, which could be used by an attacker for defense evasion or to facilitate further malicious activities.
This rule detects the use of renamed system binaries (svchost, explorer, lsass, csrss) with appended digits (e.g., svchost1.exe) being used as proxy execution. It specifically looks for HTTP responses containing a Windows executable (MZ header) where the HTTP URI matches the pattern of these renamed binaries. This behavior is often indicative of defense evasion tactics by malware.
Page 134 of 211