Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,359 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to stage large amounts of data (over 65KB) to common cloud storage services (Amazon S3, Azure Blob Storage, Google Cloud Storage) via HTTP PUT requests. This activity is indicative of data being prepared for exfiltration.
This rule detects HTTP POST requests that contain data resembling a ZIP archive (indicated by 'PK' header) and have a size greater than 50,000 bytes. This pattern is often associated with data exfiltration where collected data is archived before being sent out of the network.
This rule detects a high volume of HTTP GET requests to Azure Blob Storage, specifically targeting '.blob.core.windows.net' domains. A threshold of 50 requests within 60 seconds from a single source IP address triggers the alert, indicating a potential bulk data download activity. This could be indicative of data exfiltration or unauthorized access to cloud storage.
This rule detects a high volume of HTTP GET requests to AWS S3 buckets from a single source IP address within a short timeframe. Specifically, it triggers if more than 50 GET requests are observed within 60 seconds to hosts matching 's3.amazonaws.com' or '.s3.' patterns. This behavior can indicate an attempt to exfiltrate data or perform bulk collection from an S3 bucket.
This rule detects internal lateral movement attempts within a network using remote services. It specifically looks for TCP traffic originating from and destined to the home network, indicating internal communication. A threshold of 10 connections within 30 seconds from the same source IP is used to identify suspicious activity, suggesting a potential brute-force or rapid connection attempt indicative of lateral movement.
This rule detects attempts to query the Windows Registry via a web shell for system reconnaissance purposes. It specifically looks for HTTP requests containing the string "reg query" in the URI, indicating a command execution attempt to gather system information.
This rule detects attempts to enumerate remote registry keys via SMB. It specifically looks for network traffic on port 445 (SMB) containing the strings "winreg" and "RegQueryValue" in a case-insensitive manner. A threshold is applied to trigger an alert if 20 such events occur within a 30-second window from the same source.
This rule detects AWS IAM user account enumeration attempts via the ListUsers API call. It triggers when five or more HTTP requests to 'iam.amazonaws.com' containing 'ListUsers' in the URI are observed from a single source IP within a 30-second window. This behavior is indicative of an attacker trying to discover valid IAM user accounts.
This rule detects attempts to enumerate email accounts using Exchange Web Services (EWS). It specifically looks for HTTP requests to the '/EWS/Exchange.asmx' URI containing the 'FindItem' content in the client body. A threshold of 10 such requests within 30 seconds from the same source IP triggers the alert, indicating a potential network scan or discovery activity targeting email accounts.
This rule detects attempts to enumerate the 'Domain Admins' group over SMB (Server Message Block) using the 'NetGroupGetUsers' function. This activity is often associated with reconnaissance by attackers trying to identify high-privilege accounts within a Windows domain.
Page 159 of 211