Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,361 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects the delivery of a payload that attempts to perform process hollowing using the Runpe technique. It specifically looks for the presence of the Windows API functions 'ZwUnmapViewOfSection' and 'WriteProcessMemory' within HTTP file data being sent to a client. These functions are commonly used in process hollowing to unmap a legitimate process's memory and write malicious code into it.
This rule detects an attempt to establish a VNC (Virtual Network Computing) connection from an external source to a host within the protected network. It specifically looks for TCP SYN packets (initial connection attempt) destined for common VNC ports (5900-5910) on the home network. This could indicate an attacker attempting to gain remote access to internal systems.
This rule detects the delivery of a payload containing the string "/proc/self/mem" over HTTP to a client. This string is often associated with process memory write injection techniques, particularly on Linux systems, where an attacker might attempt to write malicious code directly into a process's memory space by interacting with the /proc/self/mem pseudo-file. The rule specifically looks for this content within the file data of an HTTP response flowing to the client.
This rule detects attempts to exploit the Log4Shell vulnerability (CVE-2021-44228) by looking for the specific JNDI injection string "${jndi:" within HTTP URI requests. This pattern is commonly used by attackers to trigger remote code execution in vulnerable Log4j versions.
This rule detects potential APC (Asynchronous Procedure Call) injection attempts over HTTP by looking for the presence of both 'QueueUserAPC' and 'OpenThread' functions in the HTTP response body (flow:to_client). This combination of functions is indicative of a payload delivery mechanism often used in APC injection techniques, which can lead to privilege escalation or arbitrary code execution.
This rule detects attempts to perform a DNS zone transfer. It specifically looks for UDP traffic on port 53 (DNS) destined for the home network, containing the byte sequence "|00 FC|" at an offset of 2 bytes with a depth of 2 bytes. This byte sequence corresponds to the 'AXFR' (Authoritative Zone Transfer) query type in a DNS request, which is often used by attackers for reconnaissance to enumerate DNS records for a domain.
This rule detects SSH banner grabbing attempts by monitoring TCP traffic to port 22 (SSH) on the home network. It specifically looks for the string "SSH-" within the first 4 bytes of the payload, indicating an attempt to identify the SSH server version. A threshold of 10 such events from the same source within 60 seconds will trigger an alert, classifying it as a network scan.
This rule detects the download of tools or files that contain 'uac' and 'bypass' in their HTTP URI. This is indicative of an attempt to download a User Account Control (UAC) bypass tool, which adversaries might use for privilege escalation on Windows systems.
This rule detects a specific type of Kerberos AS-REQ (Authentication Service Request) that lacks pre-authentication, which is characteristic of a 'Golden Ticket' attack (ATT&CK T1558.001). The rule specifically looks for UDP traffic on port 88 (Kerberos default port) to the home network, containing the byte sequences '|30|' and '|a1 03 02 01 05|'. These content checks are indicative of the structure of a Kerberos AS-REQ packet without the expected pre-authentication data.
This rule detects DNS zone transfer attempts over TCP. It specifically looks for the byte sequence "|00 FC|" in TCP traffic destined for port 53, which is indicative of a DNS AXFR (zone transfer) request. This activity is often associated with reconnaissance by attackers to gather information about a network's DNS infrastructure.
Page 145 of 211