Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,361 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects HTTP traffic where the URI contains both 'certutil' and '-decode' (case-insensitive). This pattern is indicative of an attacker using the Windows built-in 'certutil.exe' utility to decode a file downloaded via HTTP, often as part of a defense evasion or payload extraction technique. The 'flow:to_server,established' indicates that the detection is looking for this pattern in requests going from the internal network to an external server, suggesting a client-initiated download or interaction.
This rule detects HTTP POST requests to cloud compute infrastructure management endpoints, specifically Amazon EC2, Google Cloud Compute, and Azure Management. The rule is triggered if 20 such requests are observed from a single source IP within 60 seconds, indicating potential automated activity to modify cloud infrastructure for evasion purposes.
This rule detects attempts to move executable files (.exe) over SMB (Server Message Block) by looking for the 'MoveFile' string and the '.exe' extension in network traffic on port 445. This activity could indicate malware being relocated on a network share.
This rule detects the delivery of a malicious Control Panel (.cpl) file over HTTP. It specifically looks for HTTP responses containing a URI ending with ".cpl" (case-insensitive) and the "MZ" magic bytes at the beginning of the file data, indicating an executable file. This technique is often used for defense evasion and to execute malicious code.
This rule detects HTTP requests where the URI contains specific system script names like 'pubprn', 'syncappvpublishingserver', or 'winrm'. These scripts are known to be abused by attackers to proxy code execution, often as a defense evasion technique. The rule specifically looks for these patterns in HTTP URIs in traffic flowing to the server.
This rule detects attempts to execute commands indirectly via 'bash.exe' on Windows systems, specifically looking for HTTP requests where the URI contains both 'bash.exe' and the '-c' argument, which is commonly used to pass commands to a shell. This behavior is indicative of an attacker using Bash on Windows (e.g., Windows Subsystem for Linux or Git Bash) to execute arbitrary commands, potentially as part of a defense evasion or command and control tactic.
This rule detects attempts to leverage Regsvr32 for COM scriptlet remote execution. It specifically looks for HTTP traffic where the URI contains '.sct' (indicating a scriptlet file) and the file data contains XML content with the word 'registration', which are common characteristics of COM scriptlets used in Regsvr32 attacks.
This rule detects the delivery of a payload that uses InstallUtil for proxy execution. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "System.Configuration.Install" and "Installer" (case-insensitive) within the file data. This pattern is indicative of malicious use of InstallUtil, a legitimate Microsoft utility, to execute code, often for defense evasion.
This rule detects attempts to inject remote office templates via HTTP. It specifically looks for HTTP traffic flowing to the client that contains both 'attachedTemplate' and 'http' (case-insensitive) in the file data, indicating a potential attempt to load a remote template.
This rule detects HTTP responses containing XSL Transform with embedded JScript payloads. It specifically looks for the presence of 'language="JScript"' and 'WScript.Shell' within the file data of an HTTP response flowing to the client. This combination indicates an attempt to execute JScript code, potentially for malicious purposes, often associated with defense evasion or initial access techniques.
Page 136 of 211