Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,358 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to upload a web shell, specifically targeting PHP files, by looking for HTTP POST requests to a .php URI that contain the string "eval(" in the file data. This combination suggests an attacker is trying to upload or execute malicious PHP code, often used for persistence or further compromise.
This rule detects attempts to execute remote services over SMB, specifically looking for traffic on port 445 containing both the SMB signature and the 'Service Control' string. This combination suggests an attempt to interact with or manipulate services on a remote system via SMB, which is a common technique used by attackers for lateral movement or privilege escalation.
This rule detects network connections to port 9090 on the home network. The rule is specifically tagged with MITRE ATT&CK technique T1072 (System Configuration Discovery) and mentions 'Ansible/Remote Deploy', suggesting it aims to identify potential remote management or deployment activities that might use this port. It triggers on TCP SYN packets (flags:S) and uses a threshold of 5 connections from the same source within 60 seconds to reduce noise.
This rule detects the delivery of a malicious document exploiting CVE-2021-40444, an MSHTML remote code execution vulnerability. It specifically looks for HTTP traffic containing a Word document (word/document.xml) with embedded relationships that include an HTTP reference, indicating an attempt to fetch remote content, which is characteristic of the exploit delivery mechanism.
This rule detects HTTP web requests where the URI contains the string "/bin/sh" (case-insensitive). This pattern is often indicative of an attempt to execute a Unix shell command via a web application, which could be part of a command injection attack (ATT&CK T1059.004).
This rule detects potential NTLM Relay attacks over SMB. It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, and within that traffic, it identifies the presence of both the SMB protocol signature ('|FF|SMB') and the NTLMSSP (NTLM Security Support Provider) signature. This combination suggests an attempt to relay NTLM authentication.
This rule detects potential network sniffing by identifying an unusual mix of network protocols originating from a single source IP address. Specifically, it triggers an alert if a source IP sends 10 or more packets within 60 seconds that are neither TCP (protocol 6), UDP (protocol 17), nor ICMP (protocol 1). This behavior could indicate an attacker using tools to capture raw network traffic, as these tools often process protocols beyond the common ones.
This rule detects an FTP brute force attempt by monitoring TCP connections to port 21 (FTP) on the home network. It triggers an alert if 20 or more TCP SYN packets (indicating new connection attempts) are observed from the same source IP address within a 60-second window. This behavior is indicative of an attacker repeatedly trying to guess FTP credentials.
This rule detects DNS queries for typosquatted domains related to npmjs. Specifically, it looks for queries to domains ending in 'npmjs.net', 'npmjs.org', 'npmjs.io', or 'npmjs.co'. This is indicative of potential supply chain attacks or attempts to trick users into downloading malicious packages from fake registries.
This rule detects Address Resolution Protocol (ARP) spoofing attempts by looking for ARP reply packets (opcode 2) on the network. A threshold is applied to trigger an alert if 20 or more ARP replies are observed from the same source within a 10-second window, which is indicative of malicious ARP activity.
Page 170 of 211