Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,358 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects potential Tor network traffic by looking for specific byte patterns (TLS handshake ClientHello with version 1.0 or 1.1) in TCP traffic flowing from the internal network to any external destination. It uses a threshold of 3 occurrences within 60 seconds from the same source IP to reduce false positives. The rule specifically targets the initial bytes of a TLS handshake, which is a common characteristic of Tor's encrypted communication.
This rule detects HTTP requests where the URI contains the string "/var/log/" (case-insensitive). This pattern is indicative of an attempt to access system log files directly via a web server, which could be part of an information gathering or defense evasion tactic.
This rule detects HTTP requests where the User-Agent header appears to be faked or malformed. Specifically, it looks for a User-Agent string that starts with 'Mozilla/5.0' followed by an opening parenthesis, and then contains at least 200 characters before a closing parenthesis. This pattern is often used by malicious actors to evade detection by making their User-Agent string unusually long and potentially obfuscated, while still mimicking a common browser prefix.
This rule detects potential keylogger data exfiltration over HTTP POST requests. It specifically looks for HTTP POST requests with a URI containing "keys" (case-insensitive) and a data size greater than 500 bytes. This combination suggests a large amount of data, possibly keystrokes, being sent to a server.
This rule detects a UDP port scan by identifying a high volume of UDP traffic from a single source IP address to various ports on the home network within a short time frame. Specifically, it triggers an alert if more than 50 UDP packets are observed from the same source within a 10-second window, indicating a potential network reconnaissance activity.
This rule detects DNS queries to 'discord.com' with a high frequency (20 queries within 60 seconds from the same source IP). This behavior is indicative of Command and Control (C2) activity leveraging Discord webhooks, as described in MITRE ATT&CK technique T1102. Attackers often use legitimate services like Discord for C2 to blend in with normal network traffic and evade detection.
This rule detects non-HTTP traffic on TCP port 443. It specifically looks for established TCP connections to port 443 where the application layer protocol is neither TLS nor HTTP. This could indicate command and control (C2) activity attempting to blend in with legitimate HTTPS traffic.
This rule detects potential Command and Control (C2) communication over SMTP (port 25). It specifically looks for TCP traffic originating from the home network to any destination on port 25, indicating an established connection. A threshold of 10 connections within 300 seconds from the same source IP is set to reduce false positives, suggesting a high volume of SMTP activity that could be indicative of C2.
This rule detects a pattern of mass file deletion over SMB (Server Message Block) protocol. It triggers an alert if 100 or more SMB packets containing specific content (likely indicating file operations) are observed within a 10-second window, originating from the same source IP address and destined for port 445 (SMB). This behavior is often associated with ransomware or other malicious activities aiming to impact data availability.
This rule detects a high volume of DNS TXT queries originating from the home network to any destination on port 53. This behavior is indicative of potential DNS exfiltration, where data is encoded and transmitted via DNS TXT records. The rule triggers an alert if 30 or more TXT queries are observed from a single source within a 60-second window.
Page 171 of 211