Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,359 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to enumerate local administrator groups via a web shell. It specifically looks for HTTP requests containing the string "net localgroup" in the URI, which is a common command used to list local groups on a Windows system. The detection is case-insensitive and targets established HTTP connections from any source to the home network.
This rule detects attempts to enumerate local group memberships on a target system via the Server Message Block (SMB) protocol. Specifically, it looks for the 'NetLocalGroupEnum' function call within SMB traffic directed to the home network on port 445. This activity is often associated with reconnaissance phases of an attack, where an adversary is trying to discover local user groups to identify potential targets for privilege escalation or lateral movement.
This rule detects repeated HTTP requests to 'management.azure.com' with the URI '/resources', indicating an attempt to enumerate Azure resource groups. The threshold of 10 requests within 30 seconds from the same source is set to identify potential scanning or reconnaissance activities.
This rule detects multiple AWS console login attempts from a single source IP address within a short timeframe, specifically looking for access to the 'home' URI on 'console.aws.amazon.com'. This behavior could indicate an attacker attempting to discover cloud resources after gaining initial access to an AWS account.
This rule detects network traffic (specifically HTTP responses) that contains strings indicative of malware attempting to detect the presence of a hypervisor. It looks for the string "GetSystemFirmwareTable" and "VBOX" (case-insensitive) within the file data of the HTTP response. This combination suggests a malware payload checking if it's running in a virtualized environment, specifically VirtualBox, which is a common anti-analysis technique.
This rule detects attempts to enumerate device drivers on a system via a web shell. It specifically looks for HTTP requests containing the string "driverquery" in the URI, which is a command-line utility on Windows systems used to display a list of installed device drivers and their properties. The detection is case-insensitive and targets established HTTP connections to the server.
This rule detects attempts to enumerate AWS S3 object lists, which could indicate data discovery activities. It specifically looks for HTTP requests to s3.amazonaws.com or .s3-website domains containing the string 'list' in the URI, with a threshold of 10 occurrences within 30 seconds from the same source.
This rule detects attempts to query system language and locale information via a web shell. It specifically looks for HTTP requests where the URI contains the case-insensitive string "systeminfo". This activity is indicative of an attacker using a web shell to gather reconnaissance about the compromised system's configuration.
This rule detects attempts to query system geographic location information by monitoring HTTP requests to known IP lookup services such as ip-api.com, ipinfo.io, and freegeoip. The rule triggers an alert if five or more such requests are observed from the same source within a 30-second window, indicating potential reconnaissance or network scanning activity.
This rule detects attempts to enumerate Kubernetes namespaces by looking for HTTP requests to the '/api/v1/namespaces' endpoint on port 8080. This activity could indicate an attacker attempting to discover available namespaces within a Kubernetes cluster.
Page 160 of 211