Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,358 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to disable Windows Defender via a registry modification, specifically looking for the string "DisableAntiSpyware" in HTTP client body traffic. This activity is often associated with malware or adversary actions to evade defense mechanisms.
This rule detects attempts to set the hidden attribute on a file using the 'attrib +h' command over a network connection to a Windows machine (port 445). This technique is often used by attackers to hide malicious files from users and system administrators, contributing to defense evasion.
This rule detects attempts to create hidden files or directories in the /tmp directory on a remote host via SSH. Specifically, it looks for SSH traffic (tcp port 22) containing the strings "touch ." and "/tmp/." (case-insensitive). This behavior is often associated with adversaries attempting to hide their artifacts on a compromised system.
This rule detects a TLS downgrade attack where a client attempts to establish a connection using a weaker TLS protocol version, specifically TLS 1.0. This could indicate an attacker forcing a less secure communication channel to exploit vulnerabilities in older TLS versions.
This rule detects HTTP traffic indicating an Amazon EC2 instance is being reverted to a snapshot. Specifically, it looks for HTTP requests to 'ec2.amazonaws.com' with the URI containing 'RestoreSnapshotTier'. This activity could be part of a cleanup process or an attempt to restore a compromised instance to a known good state, but could also be used by an attacker for defense evasion by reverting changes.
This rule detects attempts to create new cloud instances, specifically targeting AWS EC2, by monitoring HTTP traffic for requests to 'ec2.amazonaws.com' with the 'RunInstances' URI. The rule is designed to identify suspicious activity related to the provisioning of new virtual machines in a cloud environment, potentially indicating unauthorized resource creation or evasion tactics.
This rule detects the presence of an MSBuild inline task payload within HTTP traffic. It specifically looks for the combination of the strings "<UsingTask", "TaskFactory", and "Code" (case-insensitive) within the file data of an HTTP response. This pattern is indicative of an MSBuild inline task, which can be used by attackers for proxy execution, often as a defense evasion technique.
This rule detects HTTP requests where the URI contains common developer utility executables (msbuild, csc, vbc, jsc) being used as a proxy for code execution. This behavior is often associated with defense evasion techniques where legitimate tools are leveraged for malicious purposes.
This rule detects attempts to load a PowerShell assembly reflectively in memory. It specifically looks for the string "[System.Reflection.Assembly]::Load(" within HTTP response data flowing to a client. This technique is often used by malware to execute malicious code without writing it to disk, making it a common defense evasion tactic.
This rule detects attempts to build a Docker image on a compromised host via the Docker API. It specifically looks for HTTP POST requests to the '/build' endpoint on port 2375, which is the default unsecured Docker API port. This activity could indicate an attacker leveraging a compromised system to build malicious Docker images.
Page 162 of 211