Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,360 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects an anomaly in Kerberos authentication attempts by monitoring TCP traffic to port 88 (Kerberos). It triggers an alert if a source IP address attempts Kerberos authentication 30 or more times within a 10-second window, indicating a potential brute-force or rapid authentication attempt against a domain account.
This rule detects multiple failed SSH login attempts using the username 'root' to a server on the home network. It triggers an alert if five such attempts occur within a 30-second window from the same source IP address. This behavior often indicates a brute-force attack targeting default credentials.
This rule detects attempts to log in to a web interface using default 'admin' credentials. It specifically looks for HTTP POST requests to a URI containing 'login' and a client body that contains 'admin' twice, indicating both username and password might be 'admin'.
This rule detects HTTP requests to URIs containing keywords associated with common IT management platforms (ConnectWise, Kaseya, SolarWinds, Datto, N-central). It specifically looks for established HTTP traffic flowing to the server. A threshold of 5 occurrences within 60 seconds from the same source IP is set to trigger an alert, indicating a potential remote access session or activity related to these platforms.
This rule detects RDP (Remote Desktop Protocol) sessions initiated towards the HOME_NET on port 3389. It specifically looks for the RDP connection initiation sequence (content:"|03 00|" with depth:2) and uses a threshold to detect multiple connections from the same source within a 5-minute window, which could indicate activity from a Managed Service Provider or other remote access scenarios.
This rule detects Server Message Block (SMB) access attempts from external sources to internal networks, specifically looking for NTLMSSP (NT LAN Manager Security Support Provider) authentication traffic. It triggers an alert if five such connections are observed from the same source IP within a 60-second window. This could indicate an attempt by a third-party vendor or an attacker to access internal resources via SMB.
This rule detects Address Resolution Protocol (ARP) poisoning attempts on a network segment, specifically looking for ARP reply packets (opcode 2). It uses a thresholding mechanism to trigger an alert if 10 such packets are observed from the same source within a 5-second window, indicating a potential malicious ARP spoofing activity.
This rule detects web pages that are likely part of a bank vishing callback scam. It looks for HTTP responses (flow:to_client) containing the keywords 'call', 'toll-free', and 'account' (case-insensitive) in the file data. This combination of keywords suggests a page designed to trick users into calling a fraudulent number to discuss their 'account'.
Detects Linux VDSO hijacking for privilege escalation without syscalls
Detects replacement or hijacking of Terminal Services DLL for persistence
Page 152 of 211