Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,358 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Detects possible TCP SYN port scanning activity by identifying a high volume of SYN packets from a single source within a short time window, which is commonly associated with reconnaissance tools like Nmap.
This rule detects outbound TCP connections on port 9050, which is commonly used by the Tor anonymity network. The rule is configured to trigger an alert if there are at least 3 such connections from the same source within a 60-second window, indicating potential use of Tor. The message suggests this activity is related to accessing an Initial Access Broker market.
This rule detects HTTP requests to known dedicated server rental providers (ovh.com, leaseweb.com, servermania.com) where the URI contains the word 'order'. This activity could indicate an adversary attempting to rent infrastructure for attack purposes, such as command and control servers, phishing sites, or other malicious operations.
This rule detects a drive-by download attempt initiated via a malicious advertisement. It specifically looks for HTTP responses to clients where the HTTP referer header contains common advertisement-related keywords (ad., ads., advert) and the response body contains the 'MZ' magic bytes, indicating an executable file download. This combination suggests a user was redirected from an advertisement to a site that then attempted to download an executable.
This rule detects Fast Flux DNS activity, characterized by rapid changes in IP addresses associated with the same domain within a short period. Specifically, it triggers an alert if 30 or more distinct IP addresses are observed for a single domain within a 10-second window, based on DNS queries. This behavior is often indicative of malware using fast flux techniques to evade detection and make takedowns more difficult.
This rule detects potential use of a compromised Virtual Private Server (VPS) as a proxy relay. It specifically looks for HTTP CONNECT requests, which are commonly used for tunneling traffic through a proxy. A threshold of 10 CONNECT requests within 60 seconds from a single source IP is set to identify suspicious activity, indicating a high volume of proxy usage.
This rule detects potential command and control (C2) communication originating from a compromised serverless function. It specifically looks for HTTP POST requests with a body size greater than 500 bytes, targeting domains associated with serverless platforms like Vercel (.vercel.app), Netlify (.netlify.app), and Cloudflare Pages (.pages.dev). A threshold of 10 such requests within 60 seconds from the same source IP triggers the alert, indicating a possible high-volume data exfiltration or C2 activity.
This rule detects a potential account takeover attempt via a credential stuffing attack. It specifically looks for HTTP POST requests to a URI containing 'login' (case-insensitive) from a single destination IP address, with a high frequency (50 requests within 60 seconds). This pattern suggests an automated attempt to try multiple credentials against a login endpoint.
This rule detects multiple login attempts to social media platforms (Twitter, X, Instagram, Facebook) from a single source IP address within a short timeframe. It specifically looks for HTTP POST requests to URIs containing 'login' on these domains. A threshold of 10 attempts within 30 seconds triggers the alert, indicating a potential brute-force or credential stuffing attack aimed at hijacking social media accounts.
This rule detects a brute-force attack against an IMAP email account. It triggers when a source IP attempts to connect to the IMAP port (993) on the home network 20 or more times within a 30-second window. This behavior is indicative of an attacker repeatedly trying different credentials to gain unauthorized access to an email account.
Page 178 of 211