Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,359 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects HTTP requests where the URI contains "SyncAppvPublishingServer" case-insensitively. This pattern is often associated with script proxy execution, a technique used by attackers to execute malicious scripts by leveraging legitimate system utilities. The rule specifically looks for this string in the URI of established, to-server HTTP flows, indicating potential trojan activity or defense evasion.
This rule detects HTTP requests where the URI contains both 'pubprn' and '.sct' (case-insensitive). This combination is indicative of an attempt to use the 'pubprn.vbs' script for COM scriptlet execution, a technique often employed by attackers for defense evasion.
This rule detects potential modification of a network device's system image via TFTP. It specifically looks for UDP traffic on port 69 (TFTP) where the packet size is greater than 50000 bytes and contains the byte sequence "|00 02|" at a depth of 2 bytes, which is indicative of a TFTP write request (opcode 2). The large packet size suggests a system image transfer.
This rule detects unauthorized Kerberos service ticket requests directed at a Domain Controller (DC). It specifically looks for TCP traffic to port 88 (Kerberos) on the home network, with a content match for the byte sequence '|6b|' at the beginning of the payload. A threshold of 50 requests within 10 seconds from the same source IP triggers the alert, indicating a potential brute-force or enumeration attempt against Kerberos services.
This rule detects HTTP traffic where the User-Agent header contains 'Microsoft', 'Google', or 'Amazon' (case-insensitive) and the Host header contains an IPv4 address. This combination could indicate an attacker impersonating a legitimate vendor's API client while making direct IP-based requests, potentially bypassing DNS-based security controls or targeting internal services.
This rule detects HTTP responses from a server to a client that contain the case-insensitive strings "IT Support", "helpdesk", and "password" within the file data. This combination of keywords suggests a web page designed to impersonate IT support, potentially for phishing or credential harvesting purposes.
This rule detects the string "ComRegisterFunction" within HTTP response bodies (file.data). This string is associated with .NET assembly registration, specifically when tools like Regsvcs or Regasm are used for 'Assembly Proxy Execution'. This technique is often employed by attackers for defense evasion, as it allows them to execute malicious code via legitimate Microsoft utilities.
This rule detects network traffic (specifically HTTP responses) that contains patterns indicative of timing-based anti-debugging techniques. It looks for the presence of "__rdtsc" (Read Time-Stamp Counter) and "ExitProcess" within the file data of an HTTP response, suggesting that a program might be attempting to detect a debugger by measuring execution time and exiting if debugging is detected. This is a common technique used by malware to evade analysis.
This rule detects potential in-memory PE loading without disk write by looking for specific strings in HTTP file data. It specifically searches for the strings "Assembly.Load(" and "Invoke(" (case-insensitive) within the HTTP response body (flow:to_client,established; file.data). This combination of strings is indicative of .NET applications dynamically loading assemblies into memory and then executing methods, which can be a technique used by malware to avoid writing executables to disk.
This rule detects the string "sekurlsa" within the HTTP URI, which is commonly associated with the Mimikatz tool attempting to dump credentials from the Local Security Authority Subsystem Service (LSASS) process. The detection is case-insensitive and targets traffic flowing from the client to the server.
Page 163 of 211