Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,358 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to modify Cisco router firmware using ROMMONkit. It specifically looks for TCP traffic to the HOME_NET on port 23 (Telnet) containing the case-insensitive strings "rommon" and "tftpdnld". This combination suggests an attempt to interact with the router's ROM Monitor mode for firmware manipulation, often associated with malicious activities like installing backdoors or persistent malware.
This rule detects network traffic on port 445 (SMB) containing the strings "LSASS" and "AddDll" (case-insensitive). This combination of strings suggests an attempt to register a malicious DLL with the Local Security Authority Subsystem Service (LSASS) for persistence, a technique often used by malware to maintain access on a compromised system. The flow is set to 'to_server' and 'established', indicating an outgoing connection from the monitored network to a server, and that the TCP connection has been successfully established.
This rule detects network traffic on TCP port 445 (SMB) containing the case-insensitive strings "powercfg" and "change". This combination suggests an attempt to modify system power settings, potentially to prevent a system from sleeping or shutting down, which could be a persistence mechanism.
This rule detects the delivery of a file over HTTP that contains the strings "AppDomainManager" and "CreateDomain" (case-insensitive). This combination of strings is indicative of an attempt to hijack the AppDomainManager, a technique used for persistence in .NET applications, often associated with T1574.014 (AppDomainManager Hijacking) from MITRE ATT&CK.
This rule detects the delivery of shellcode designed to hijack the KernelCallbackTable. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "KernelCallbackTable" and "NtUserSetWindowsHookEx" (case-insensitive) within the file data. This technique is often used for privilege escalation or persistence by redirecting kernel callbacks to malicious code.
This rule detects network traffic on TCP port 445 (SMB) containing the strings "icacls" and "grant" (case-insensitive). This combination suggests an attempt to modify file or directory permissions, specifically granting permissions, which could be indicative of an attacker exploiting a service binary file permission weakness to establish persistence or elevate privileges. The rule is triggered when these strings are observed in traffic flowing to the server.
This rule detects the deployment of a potentially malicious middleware component on an application server. It specifically looks for HTTP POST requests to port 8080 with a URI containing 'deploy' (case-insensitive) and a data size greater than 10000 bytes. This pattern is indicative of a large payload being sent to deploy an application or component, which could be malicious in nature.
This rule detects HTTP requests that contain both 'config' and 'lock' in the URI, suggesting an attempt to access or manipulate configuration files that might be locked, potentially indicating an exclusive lock on a security tool's configuration file. The rule is classified as 'trojan-activity'.
This rule detects attempts to write shell event hook scripts, specifically those using 'trap' and 'SIGHUP', over an SSH connection. This activity is often associated with persistence mechanisms where an attacker sets up a script to execute upon certain shell signals, such as a hangup signal, to maintain access or execute malicious code.
This rule detects network traffic indicative of a remote WMI event subscription being registered. Specifically, it looks for TCP traffic on port 135 (typically used by Microsoft RPC and DCOM, which WMI can leverage) directed to the home network, containing the string "__EventConsumer" case-insensitively. This activity can be a sign of persistence mechanisms being established by attackers.
Page 174 of 211