Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,361 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects potential DNS tunneling activity by identifying unusually large DNS queries. Specifically, it looks for UDP packets on port 53 (DNS) that contain the DNS query header (01 00 00 01) and have a data size greater than 100 bytes. A threshold of 10 such queries from the same source within 60 seconds is set to reduce false positives.
This rule detects internal SMTP traffic that contains both 'Content-Type: application/' and 'filename=' in the email body. This combination is often indicative of an attachment being sent, and in the context of 'Lateral Phishing' (T1534), it suggests an attempt to send malicious attachments internally. The rule is set to trigger an alert if 5 such events occur from the same source IP within 300 seconds, indicating a potential automated or high-volume internal phishing attempt.
This rule detects attempts to establish a TCP connection to port 5985 on the home network, which is commonly used for WinRM (Windows Remote Management) over HTTP. The rule is configured to alert if three such connection attempts are made from the same source within a 60-second window, indicating potential lateral movement activity using WinRM.
This rule detects LDAP user enumeration attempts by identifying multiple LDAP queries containing "(objectClass=user)" within a short timeframe (10 queries in 60 seconds) directed to a server on port 389. This behavior is indicative of an attacker trying to discover valid user accounts.
This rule detects HTTP requests containing 'phpinfo' in the URI, which is commonly used for system information reconnaissance. This activity is associated with MITRE ATT&CK technique T1082 (System Information Discovery).
This rule detects large data uploads over HTTPS (port 443) from the home network to any external destination. Specifically, it triggers if the data size in a single TCP flow to the server exceeds 65,000 bytes. To prevent excessive alerts, it uses a threshold of 20 such events within 60 seconds, tracked by the source IP address. This behavior is indicative of potential data exfiltration.
This rule detects TCP network connections originating from the internal network ($HOME_NET) to any external destination on port 1337. The detection is specifically for the initial SYN packet of a TCP handshake (flags:S) and is categorized as 'trojan-activity'. Port 1337 is commonly associated with Remote Access Trojans (RATs) for Command and Control (C2) communications, aligning with MITRE ATT&CK technique T1219.
This rule detects bulk Server Message Block (SMB) file read activity from a network share. It specifically looks for TCP traffic on port 445 (SMB) from any source within the home network to any destination within the home network, indicating established connections. The rule triggers if it observes 100 or more SMB packets (identified by the content "|FF|SMB") within a 60-second window from a single source IP address. This behavior could be indicative of data collection or exfiltration from network shares.
This rule detects sustained outbound network traffic with a data size greater than 1000 bytes, originating from the home network. It triggers an alert if 200 such connections are observed from the same source IP address within a 300-second window. This behavior is indicative of automated exfiltration, where an attacker continuously sends data out of the network.
This rule detects potential command and control (C2) communication related to disk wiping activities. It specifically looks for the keywords "wipe" and "disk" (case-insensitive) within 50 bytes of each other in TCP traffic flowing from the server to the client. This pattern suggests a C2 server instructing a compromised client to perform disk wiping, which aligns with the MITRE ATT&CK technique T1561 (Disk Wipe) under the Impact tactic.
Page 146 of 211