Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,358 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to modify SSH authorized_keys files over a network connection, which could indicate an attacker establishing backdoor access. It specifically looks for the string "authorized_keys" within TCP traffic destined for port 22 (SSH).
This rule detects when a global administrator role is assigned in Azure via the Graph API. It specifically looks for HTTP POST requests to 'graph.microsoft.com' with 'assignLicense' in the URI.
This rule detects attempts to push potentially malicious container images to an internal registry. It specifically looks for HTTP POST requests to '/v2/' and '/blobs/uploads/' URIs, indicating an image layer upload, with a data size greater than 100KB. This behavior could be indicative of an attacker attempting to establish persistence or introduce malicious code into the container environment.
This rule detects potential DLL hijacking attempts targeting Terminal Services (RDP) by looking for the string "termsrv.dll" within TCP traffic destined for port 3389 (RDP). This could indicate an attacker attempting to load a malicious DLL in place of the legitimate termsrv.dll to maintain persistence or execute arbitrary code.
This rule detects network traffic indicating the installation of a Transport Agent on an Exchange server. It specifically looks for the strings "TransportAgent" and "Install-TransportAgent" in TCP traffic directed to port 25 of the home network, suggesting a potential malicious or unauthorized installation of an Exchange Transport Agent.
This rule detects attempts to create a stored procedure in a Microsoft SQL Server database that includes the 'xp_cmdshell' extended stored procedure. 'xp_cmdshell' allows execution of operating system commands directly from SQL Server, and its use in a newly created stored procedure can indicate an attacker establishing persistence or attempting to execute arbitrary commands on the underlying system.
This rule detects a sequence of TCP SYN packets with a zero data size, originating from any source to any destination within the home network. The detection is triggered when 5 such packets are observed from the same source within a 3-second window. This pattern is indicative of a 'Magic Packet Implant Activation Sequence', which could be used by an attacker for persistence or command and control.
This rule detects the delivery of a malicious Outlook form script over HTTP. It specifically looks for HTTP traffic flowing to the client that contains the strings "IPM.Note", "Script", and "VBScript" within the file data, indicating an attempt to deliver a VBScript-based Outlook form.
This rule detects the remote creation of a WMI event subscription, specifically looking for '__EventFilter' and 'CommandLineEventConsumer' within TCP traffic on port 445. This activity is often associated with persistence mechanisms used by attackers.
This rule detects the remote installation of a new Windows service over SMB (Server Message Block) protocol. It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, containing the strings "CreateService" and "svcctl" (case-insensitive). This combination indicates an attempt to create a new service remotely, which can be a method for persistence or privilege escalation by attackers.
Page 173 of 211