Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,361 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects the download of a malicious Office template file (.dotm) over HTTP. The rule specifically looks for HTTP traffic flowing to the client that contains the ".dotm" string in the URI, indicating a potential template injection attack where a malicious template is delivered to a user.
EternalBlue SMB Exploit Attempt
Suricata
This rule detects attempts to exploit the EternalBlue vulnerability over SMB (Server Message Block) protocol. It specifically looks for a sequence of bytes indicative of the exploit payload within the SMB traffic.
IIS Native Module Upload Attempt
Suricata
This rule detects attempts to upload a DLL file to an 'modules' directory on an IIS web server using an HTTP PUT request. This activity is indicative of an adversary attempting to establish persistence by installing a malicious IIS native module.
This rule detects TFTP (Trivial File Transfer Protocol) requests for bootloader files. Specifically, it looks for UDP traffic on port 69 (the standard TFTP port) where the packet content starts with the byte sequence "00 01". This pattern is characteristic of a TFTP read request for a file, often used in network booting scenarios to retrieve bootloader files. The rule flags this activity as a "Possible Pre-OS Persistence" mechanism, suggesting an adversary might be attempting to establish persistence before the operating system fully loads, potentially through techniques like bootkits or modifying boot records.
HTTP Server Banner Grabbing
Suricata
This rule detects HTTP server banner grabbing activity. Specifically, it triggers when a client sends a 'HEAD' HTTP request to a server on port 80, and this activity occurs at a high frequency (20 times within 30 seconds from the same source IP). Banner grabbing is a reconnaissance technique used to identify the type and version of web servers, which can then be used to find known vulnerabilities.
LDAP Domain Trust Enumeration
Suricata
This Suricata rule detects attempts to enumerate domain trusts via LDAP. It specifically looks for TCP traffic on port 389 (LDAP) where the content of the packet contains the string "(objectClass=trustedDomain)" in a case-insensitive manner. This activity is indicative of an attacker trying to discover relationships between domains, which is a common step in reconnaissance and lateral movement within an Active Directory environment.
This rule detects potential SSH agent forwarding abuse, which can be used for lateral movement within a network. It specifically looks for a byte sequence ('|00 00 00 1c 0b|') within TCP traffic on port 22 (SSH) flowing to the server, indicating an established connection. This byte sequence is characteristic of SSH agent forwarding requests.
This rule detects a DNS Amplification Distributed Denial of Service (DDoS) attack. It triggers an alert when UDP traffic destined for port 53 (DNS) on the home network has a data size greater than 512 bytes and exceeds a threshold of 100 packets within 5 seconds, tracked by destination IP address. This pattern is indicative of a DNS amplification attack where small queries result in large responses, overwhelming the target.
This rule detects potential DNS response spoofing or DNS hijacking attempts. It specifically looks for UDP traffic on port 53 (DNS) where a high number of responses (5 within 10 seconds) are observed for a given destination IP address, which could indicate an attacker attempting to inject malicious DNS responses.
MySQL Database DROP TABLE Attack
Suricata
This rule detects attempts to drop tables in a MySQL database. It specifically looks for the 'DROP TABLE' string in TCP traffic directed to the standard MySQL port (3306) on the home network. This activity is often indicative of malicious intent, such as data destruction or database tampering.
Page 144 of 211