Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,358 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects LDAP bind requests originating from an external source to a domain controller (port 389) within the home network. It specifically looks for the 'bindRequest' content in TCP traffic and triggers an alert if 10 such requests are observed from the same source within a 30-second window. This could indicate an attempt to enumerate or authenticate against directory services from outside the internal network, potentially as part of initial access or reconnaissance.
This rule detects TFTP (Trivial File Transfer Protocol) traffic on UDP port 69, specifically looking for a content pattern that indicates a firmware push. The pattern '|00 02|' at the beginning of the UDP payload suggests a TFTP write request (opcode 2), which is commonly used for uploading files, including firmware, to network devices. The rule is designed to alert on such activity directed towards the local network ($HOME_NET).
This rule detects DNS queries for domains that resemble update servers used in the SolarWinds supply chain attack. Specifically, it looks for DNS queries containing 'update' followed by 'solarwinds', 'orion', 'avupdate', or 'antivirus' in the domain name. This pattern was associated with the SUNBURST backdoor's communication with its command and control infrastructure.
This rule detects attempts to download typosquatted NPM packages from registry.npmjs.org. It specifically looks for HTTP requests to the NPM registry where the URI contains common typos of popular packages like 'lodash', 'requests', 'express', 'mongoose', and 'momentjs'. This indicates a potential supply chain attack where developers might accidentally download malicious packages due to a typo.
This rule detects HTTP responses containing JavaScript that attempts to redirect the user's browser to another page and executes code using 'eval()'. This combination is often used in malicious web pages to redirect users to exploit kits or phishing sites, and to obfuscate malicious JavaScript.
This rule detects HTTP responses from a web server to a client that contain JavaScript code attempting to redirect the user's browser. Specifically, it looks for the string "window.location.replace" within the HTTP response body (file.data) when the HTTP referer header indicates the request originated from Google or Bing search results. This pattern is often associated with content injection attacks where malicious code is injected into legitimate search results to redirect users to malicious sites.
This rule detects potential phishing attempts delivered via Slack messages. It triggers when HTTP traffic to 'slack.com' contains '/messages/' in the URI, indicating a Slack message context, and has a threshold of 5 occurrences within 60 seconds from the same source.
This rule detects Address Resolution Protocol (ARP) announcements from new or unknown devices on the network. Specifically, it looks for ARP packets with an opcode of '2', which signifies an ARP reply. The rule uses a threshold to trigger an alert if a new ARP reply is observed from a source within a 5-second window, indicating a potential new device joining the network or an attempt at ARP spoofing.
Detects unusually large HTTP POST requests which may indicate data exfiltration activity over web protocols. The rule specifically looks for HTTP POST methods and is designed for Suricata, a network intrusion detection system.
This rule detects unusually long DNS queries (40 characters or more) which can be indicative of DNS tunneling. DNS tunneling is a technique used by adversaries for command and control (C2) communication or data exfiltration, where data is encoded within DNS queries and responses to bypass network security controls.
Page 177 of 211