Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,362 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to purge mailbox data using Exchange Web Services (EWS) by looking for HTTP requests to '/EWS/Exchange.asmx' containing the 'HardDelete' string in the client body. This activity is indicative of an attacker attempting to remove evidence or sensitive information from a compromised mailbox.
This rule detects network traffic containing the string "/..namedfork/rsrc" (case-insensitive) over TCP to port 22 (SSH). This pattern is indicative of an attempt to use macOS resource forks to hide payload data, a technique often employed by malware for defense evasion. The detection specifically targets traffic originating from and destined for the home network, suggesting an internal system attempting to exfiltrate or receive hidden data.
This rule detects the creation of a new inbox rule via Exchange Web Services (EWS) that could be used to hide phishing replies. Specifically, it looks for HTTP traffic to '/EWS/Exchange.asmx' with 'NewInboxRule' in the client body, indicating an attempt to create a new inbox rule.
This rule detects attempts to unset the HISTFILE environment variable over a TCP connection to port 22 (SSH). Unsetting HISTFILE is a common technique used by attackers to prevent their commands from being recorded in the shell history, thereby evading detection and forensic analysis. The rule specifically looks for the string "unset HISTFILE" case-insensitively within the TCP stream.
This rule detects the delivery of a VBA stomped Office document via HTTP. It looks for specific content within the HTTP response body, indicating a Microsoft Office document that has been manipulated to hide malicious VBA macros. The rule specifically checks for the presence of "[Content_Types].xml", "vbaProject", and "PerformanceCache" within the file data, which are characteristic of Office documents containing VBA macros, with "PerformanceCache" being a potential indicator of VBA stomping.
This rule detects attempts to clear the Bash history using the 'history -c' command over an established SSH connection. It specifically looks for the case-insensitive string 'history -c' within TCP traffic flowing from the client to the server on port 22 (SSH). This activity is often associated with an attacker attempting to cover their tracks after gaining unauthorized access.
This rule detects HTTP traffic where the host header or URI contains keywords associated with virtual machine software (virtualbox, vmware, qemu) and the URI also contains the word "create". This combination suggests the potential creation or interaction with virtual machines, which could be used for defense evasion by adversaries to hide malicious activity.
This rule detects network traffic over SMB (port 445) that contains patterns indicative of a payload hidden within an NTFS Alternate Data Stream (ADS). Specifically, it looks for the string ":$DATA" followed by ".exe" (case-insensitive) in the TCP payload, which is a common technique used by malware to conceal executable files within legitimate files.
This rule detects network traffic containing the strings "SW_HIDE" and "CreateProcess" within file data in an HTTP response. This combination suggests an attempt to execute a process with a hidden window, which is a common technique used by malicious software to evade detection.
This rule detects attempts to modify an EC2 instance's attributes, specifically looking for the 'ModifyInstanceAttribute' API call to 'ec2.amazonaws.com'. This activity could indicate an attacker attempting to evade detection or alter the instance's configuration for malicious purposes.
Page 135 of 211