Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,361 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to add email delegate permissions via the Microsoft Graph API. It specifically looks for HTTP PATCH requests to 'graph.microsoft.com' with a URI containing 'mailboxSettings'. This activity could indicate an attacker attempting to gain unauthorized access to a user's mailbox by granting delegate access to another account, which is a common persistence technique.
This rule detects when additional cloud credentials (Access Keys) are added to an AWS IAM user. It specifically looks for HTTP traffic to 'iam.amazonaws.com' containing 'CreateAccessKey' in the URI, indicating an attempt to create new access keys.
This rule detects network traffic containing the string "/etc/rc" over SSH (port 22) to a server within the home network. This pattern suggests an attempt to modify an RC script for persistence on a Linux system, potentially by an attacker who has gained SSH access.
This rule detects the deployment of a network logon script named 'logon.bat' within the 'SYSVOL' share over SMB (port 445). This activity is often associated with persistence techniques where an attacker modifies or creates logon scripts to execute malicious code when users log in to the domain.
This rule detects modifications to macOS Login Hook scripts via SSH. Login Hooks are scripts that execute when a user logs in or out, and their modification can be an indicator of persistence mechanisms used by attackers. The rule specifically looks for TCP traffic on port 22 (SSH) containing the string 'LoginHook' in a case-insensitive manner, indicating an attempt to interact with or modify these scripts.
This rule detects the string "flash write" in TCP network traffic flowing to a server, indicating a potential command to reflash component firmware. This activity could be associated with persistence techniques where an attacker modifies firmware to maintain access or control over a system.
This rule detects the delivery of potentially malicious Office add-in files (VSTO, XLA, XLAM) or COM files over HTTP. It specifically looks for these file extensions in the HTTP URI and verifies that the file content starts with 'MZ', indicating a Windows executable or DLL.
This rule detects the creation of malicious Outlook rules via Exchange Web Services (EWS). It specifically looks for HTTP traffic to '/EWS/Exchange.asmx' containing the 'CreateRule' string in the client body, indicating an attempt to establish persistence within an Outlook environment.
This rule detects network traffic attempting to register an AppCert DLL in the Windows Registry for injection purposes. Specifically, it looks for TCP traffic on port 445 (SMB) directed to the home network, containing the case-insensitive string "AppCertDlls". This activity is indicative of a persistence mechanism where a malicious DLL is configured to be loaded into processes, often for privilege escalation or code injection.
This rule detects network traffic containing the string "sethc.exe" over TCP port 445 (SMB). This is indicative of an attacker attempting to exploit the 'Sticky Keys' accessibility feature for backdoor access, often by replacing the sethc.exe binary with a malicious executable. The detection specifically looks for this string in traffic flowing to the server on an established connection.
Page 148 of 211