Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,358 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects access to known dark web credential markets by inspecting HTTP host headers for specific domain patterns. It triggers an alert if a client on the home network attempts to connect to 'genesis.market', 'russianmarket', or '2easy.shop'. This indicates potential reconnaissance or direct access to platforms where stolen credentials are traded.
This rule detects HTTP traffic to 'zoominfo.com' with a high frequency (15 times in 60 seconds from the same source IP). This behavior is indicative of automated data harvesting or reconnaissance activities targeting corporate information.
This rule detects attempts to download raw payload files (PowerShell scripts, executables, DLLs, batch files, VBScripts, Python scripts, or shell scripts) from raw.githubusercontent.com. This activity is often associated with adversaries attempting to retrieve malicious tools or scripts from code repositories.
TLS Certificate Harvesting Sweep
Suricata
This rule detects a TLS certificate harvesting sweep, characterized by a high volume of TLS Server Name Indication (SNI) requests from a single source within a short period. This behavior is indicative of reconnaissance activities where an attacker is attempting to collect information about services running on various hosts by observing their TLS certificates.
This rule detects a NetBIOS Name Service enumeration sweep. It triggers an alert when 15 or more UDP packets destined for port 137 (NetBIOS Name Service) on the home network are observed from a single source IP within a 30-second window. This behavior is indicative of an attacker attempting to discover hosts and services on a network.
This rule detects HTTP requests to 'crt.sh', a Certificate Transparency log search engine. Such requests can indicate an adversary performing reconnaissance to gather information about an organization's digital certificates and domains.
This Suricata rule detects potential steganography payloads embedded within image downloads. It specifically looks for the JPEG file signature `FF D8 FF` within the first 3 bytes of an HTTP response, combined with a large file size (greater than 500KB). The rule also includes a threshold to prevent excessive alerts, triggering if 5 such downloads occur from the same destination within 60 seconds. This behavior is indicative of an attempt to hide malicious code or data within seemingly innocuous image files to evade detection.
This rule detects potential domain fronting by identifying a mismatch between the Server Name Indication (SNI) field in the TLS handshake and the Host header, specifically when the SNI field contains domains commonly used for content delivery networks (CDNs) like cloudfront.net, azureedge.net, or fastly.net. This technique can be used to obfuscate the true destination of network traffic, often for malicious purposes such as bypassing censorship or exfiltrating data.
This rule detects attempts to download known exploit framework tools such as Metasploit, Cobalt Strike, Empire, Covenant, Sliver, or Havoc by inspecting HTTP URI content. The detection is based on case-insensitive pattern matching within the HTTP URI.
Payload Download from GitLab Raw
Suricata
This rule detects attempts to download executable or script files (PowerShell, executable, DLL, shell script, Python script) from the 'raw' content section of gitlab.com. This behavior is often associated with adversaries staging or retrieving malicious payloads.
Page 167 of 211