Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,358 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects HTTP requests to 'api.shodan.io', indicating a potential query to the Shodan Internet Scan Database. This activity could be part of reconnaissance efforts by an attacker or security researcher to gather information about internet-connected devices and services.
This rule detects HTTP requests to known Certificate Transparency (CT) log query services such as crt.sh, censys.io, and certspotter.com. These services are often used by attackers during the reconnaissance phase to gather information about an organization's SSL certificates and subdomains.
This rule detects HTTP requests to VirusTotal's domain lookup service (www.virustotal.com/domain/). This activity is often associated with passive DNS lookups, which can be part of reconnaissance efforts by attackers or security researchers to gather information about a target's infrastructure.
This rule detects HTTP requests made to the SecurityTrails API (api.securitytrails.com). SecurityTrails is a service that provides access to passive DNS databases and other domain-related intelligence. Such queries can indicate reconnaissance activity by an attacker or security researcher gathering information about a target domain.
This rule detects HTTP requests where the User-Agent header contains the string "feroxbuster" (case-insensitive). Feroxbuster is a command-line tool used for content discovery on web servers, often employed in penetration testing or reconnaissance phases to find hidden directories and files. Detecting its User-Agent can indicate an active directory brute-force or content discovery scan against the network.
Stealth XMAS Scan Port Probe
Suricata
This rule detects a Stealth XMAS Scan Port Probe. An XMAS scan is a type of port scan where the FIN, PSH, and URG flags are set in the TCP header. This type of scan attempts to determine if a port is open by exploiting the TCP RFC 793. If a port is closed, the target system should respond with an RST packet. If the port is open, no response is expected. The rule specifically looks for TCP packets with the FPU (FIN, PSH, URG) flags set, originating from any source IP and port, destined for any IP on the local network ($HOME_NET) on any port. A threshold is applied to trigger an alert if 10 such packets are observed from the same source within a 30-second window, indicating a scanning activity.
This rule detects potential business partner directory scraping by monitoring HTTP requests to the server. It triggers an alert if a client makes 15 or more requests containing 'partners' (case-insensitive) in the URI within a 30-second window. This behavior could indicate an attacker or automated tool attempting to enumerate or collect information about an organization's business partners.
This rule detects spearphishing emails sent over SMTP that contain an Office document attachment. It specifically looks for emails with a 'Content-Type: application/' header, a 'filename=' attribute, and the '.docx' extension in the content, indicating a Microsoft Word document.
This rule detects HTTP requests to known threat intelligence portals associated with dark web monitoring. It specifically looks for hostnames containing 'intel471', 'kela.io', 'recordedfuture', or 'flashpoint'. This could indicate an analyst or system accessing threat intelligence, or potentially an adversary performing reconnaissance.
This rule detects attempts to harvest credentials using a fake Microsoft login page. It triggers when HTTP traffic from the server to the client contains both "microsoftonline" and "password" in the file data, and the HTTP host is an IP address. This combination suggests a phishing attempt where a malicious server is impersonating a Microsoft login page to capture user credentials.
Page 166 of 211