Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,358 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to abuse native Windows API functions, specifically 'NtCreateProcess', via web shell execution. It looks for HTTP requests where the URI content includes 'NtCreateProcess' in a case-insensitive manner, indicating a potential web shell trying to create a new process on the server.
This rule detects HTTP POST requests to 'cloudfunctions.net', indicating a Google Cloud Function is being triggered for execution. The rule uses a threshold to alert only if 20 such requests are observed from the same source within 60 seconds, aiming to reduce noise from legitimate, infrequent triggers.
This rule detects HTTP POST requests to AWS Lambda invocation endpoints, specifically targeting URLs matching the pattern '/lambda.[a-z0-9-]+.amazonaws.com' with the URI '/invocations'. A threshold of 20 such requests within 60 seconds from a single source IP triggers the alert, indicating potential code execution activity via AWS Lambda.
This rule detects when a file containing both ".plist" in its HTTP URI and "LaunchDaemon" in its content is delivered via HTTP. This combination suggests the download of a macOS LaunchDaemon property list file, which could be used for persistence or privilege escalation on macOS systems.
This rule detects the string "launchctl load" within TCP traffic on port 22 (SSH). This indicates an attempt to load a launchd service on a macOS or Linux system via a remote SSH connection. This activity could be legitimate system administration but also could be indicative of an attacker establishing persistence or executing malicious services.
This rule detects potential DCOM lateral execution attempts. It specifically looks for TCP traffic to port 135 (typically used by DCOM/RPC) on the home network, containing the byte sequence '|05 00 0b|' within the first 3 bytes of the payload. A threshold of 5 occurrences from the same source within 30 seconds is set to reduce false positives.
This rule detects the download of a potential trojanized installer file over HTTP. It looks for HTTP responses to clients that contain 'setup', 'install', or 'installer' in the URI, have a file size greater than 500KB, and contain the 'MZ' header, indicating a Windows executable. This combination suggests a user is downloading an executable that could be malicious.
This rule detects the download of archive files (ZIP, RAR, 7Z, TAR.GZ) over HTTP that contain an executable file signature ('MZ' header). This combination suggests a potential user execution scenario where a malicious executable might be delivered within an archive.
This rule detects HTTP POST requests to the '/sdk/vimService' URI on TCP port 443 (HTTPS) targeting an ESXi host. This pattern is indicative of direct API command execution attempts against the VMware vSphere API, which could be used by an attacker to interact with or control the ESXi hypervisor.
This rule detects when an executable file (.exe) is copied to a share associated with a removable drive (indicated by 'USBSTOR') over the SMB protocol. This could indicate an attempt to transfer malicious executables to or from a removable device.
Page 176 of 211