Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,359 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects HTTP PUT requests to s3.amazonaws.com that include the 'x-amz-copy-source' header and have a data size greater than 1000 bytes. This combination of indicators suggests an attempt to copy data from one S3 bucket to another, potentially indicating data exfiltration to an attacker-controlled AWS account.
This rule detects potential VXLAN traffic duplication for exfiltration purposes. It specifically looks for TCP traffic on port 4789 (the default VXLAN port) directed towards the home network. A threshold of 10 connections from the same source within 30 seconds triggers the alert, indicating a high volume of VXLAN traffic that could be indicative of data exfiltration.
This rule detects HTTP traffic indicating a potential cloud service compromise for cryptomining. Specifically, it looks for HTTP requests to 'ec2.amazonaws.com' with the URI containing 'RunInstances' and the client body containing 'p3' (case-insensitive). This combination suggests an attempt to provision EC2 instances, possibly for cryptomining, using a compromised AWS account.
This rule detects network traffic patterns indicative of the XMRig cryptominer communicating with a mining pool. Specifically, it looks for HTTP POST requests to the URI '/api/v1/jobs' with 'job_id' present in the client body, which is a common behavior for XMRig when requesting mining jobs.
This rule detects attempts to abuse an IoT device's firmware update page by sending a large POST request containing the word "firmware" (case-insensitive) to TCP port 80 on the home network. This activity is indicative of an attempt to corrupt the device's firmware, potentially leading to denial of service or unauthorized control.
This rule detects attempts to exfiltrate sensitive data by posting it to common text sharing services. It specifically looks for HTTP POST requests with a body size greater than 1000 bytes directed towards domains associated with services like paste.ee, hastebin, ghostbin, and privatebin.
This rule detects attempts to remotely lock out user accounts via SMB (Server Message Block) by looking for specific content within TCP traffic on port 445. It specifically targets the 'NetUserSetInfo' function call, which can be used to modify user account properties, in conjunction with the keyword 'lockout'. This combination suggests an attacker is attempting to trigger a mass account lockout.
This rule detects a Slowloris Slow HTTP DoS attack. It triggers when a single source IP sends 100 HTTP GET requests within a 300-second window to the internal network. Slowloris attacks work by holding open many HTTP connections to a web server, eventually exhausting the server's connection pool and making it unavailable to legitimate users.
This rule detects an application layer HTTP POST flood, which is a type of Denial of Service (DoS) attack. It triggers when a single destination receives 200 or more HTTP POST requests within a 10-second window. This high volume of POST requests is indicative of an attempt to exhaust server resources or bandwidth.
This rule detects a denial-of-service attack characterized by a high volume of HTTP GET requests targeting a server within a short timeframe. Specifically, it triggers if a single destination IP address receives 500 or more HTTP GET requests within a 10-second window, indicating a potential HTTP request flood aimed at exhausting service resources.
Page 156 of 211