Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,359 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects network traffic on port 445 (SMB) containing the string "SetFileSecurity" (case-insensitive). This string is associated with modifying file security descriptors, specifically Discretionary Access Control Lists (DACLs), which can be used by attackers to hide malicious files or achieve persistence by altering permissions.
This rule detects attempts to use 'mavinject.exe' for DLL injection into a running process over HTTP. It specifically looks for HTTP requests containing 'mavinject' and '/INJECTRUNNING' in the URI, indicating a potential malicious use of the Mavinject utility for defense evasion.
This rule detects potential credential stuffing attacks by identifying HTTP requests to login pages that use user agents commonly associated with automated tools like 'python-requests', 'Go-http-client', or 'curl'. It triggers if 20 such requests are observed from the same source IP within 30 seconds, indicating a high volume automated attempt.
This rule detects JavaScript code being delivered to a client that attempts to capture form field data, specifically looking for 'document.querySelector', 'password', and 'fetch(' within HTTP response data. This behavior is indicative of an attempt to exfiltrate credentials from a login page.
This rule detects the presence of a web portal login page skimmer script by looking for specific JavaScript keywords within HTTP response data. It specifically searches for the combination of 'addEventListener', 'keydown', and 'XMLHttpRequest' (case-insensitive) in the data flowing from the server to the client. This combination suggests a script designed to capture user input (like keystrokes) and exfiltrate it via XMLHttpRequest, a common technique used by web skimmers to steal credentials.
This rule detects attempts to spoof a Windows login credential dialog box over HTTP. It specifically looks for the string "CredUIPromptForCredentials" (case-insensitive) within the file data of HTTP traffic flowing from the server to the client. This string is associated with the Windows Credential UI API, and its presence in unexpected contexts, especially in HTTP responses, could indicate a phishing attempt or malware trying to trick users into entering credentials.
This rule detects attempts to copy SSL private key files over SMB. It specifically looks for network traffic on port 445 (SMB) containing the strings ".key" and "private" (case-insensitive) in the data being sent to the server. This activity could indicate an attacker attempting to exfiltrate sensitive cryptographic material.
This rule detects HTTP requests that attempt to access the '.aws/credentials' file, which typically contains AWS access keys and secret keys. This indicates an attempt to discover or exfiltrate sensitive AWS credentials from a web server, potentially exposing cloud resources.
This rule detects network traffic to port 88 (Kerberos) that exhibits characteristics of a vulnerability exploit for credential access. Specifically, it triggers an alert if there are 30 or more TCP connections to port 88 on the HOME_NET within a 5-second window from a single source IP address, indicating a potential brute-force or rapid credential access attempt against a Kerberos service.
This rule detects attempts to copy the Chrome Login Data SQLite file over SMB. The rule specifically looks for SMB traffic (port 445) containing the strings "Login Data" and "AppData\Local\Google\Chrome" (case-insensitive). This activity is indicative of an attacker trying to exfiltrate sensitive browser data, specifically stored credentials.
Page 164 of 211