Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,358 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects a brute force attempt against a cloud management console. It triggers when a source IP address makes 10 or more HTTP POST requests to a URI containing 'signin' within a 30-second window. This pattern is indicative of an automated attempt to guess credentials for a login page.
This rule detects attempts to purchase code signing certificates by monitoring HTTP traffic for connections to known certificate authorities (Sectigo, Comodo, Digicert) and the presence of the term 'codesigning' in the URI. This could indicate an adversary attempting to acquire legitimate code signing certificates for malicious purposes, such as signing malware to evade detection.
This rule detects the use of a code signing certificate that is suspected to be stolen. It specifically looks for HTTP traffic where the TLS certificate subject contains an organization name matching a common corporate naming convention (e.g., 'O=Company Inc', 'O=Company LLC', 'O=Company Ltd', 'O=Company Corp') and the issuer is 'DigiCert'. This combination suggests a potentially legitimate certificate being used in an unauthorized context, possibly for signing malicious software.
This rule detects HTTP PUT requests to known remote file hosting services (transfer.sh, file.io, gofile.io, anonfiles). This activity is indicative of payload staging, where an attacker uploads malicious files or tools to a remote server for later use in an attack, often as part of the resource development phase of the attack lifecycle.
This rule detects attempts to upload executable files (specifically Windows MZ executables) to common cloud storage services like Amazon S3, Google Cloud Storage, and Azure Blob Storage. It looks for HTTP PUT requests containing the 'MZ' magic bytes at the beginning of the file data, indicating a Windows executable, with a file size greater than 100KB, directed towards known cloud storage domains.
This rule detects potential watering hole attacks by identifying HTTP responses (flow to client) that contain a combination of HTML script tags, 'document.write', and 'eval(' within the file data. This pattern is indicative of malicious JavaScript injection designed to execute code on the client side.
This rule detects network traffic to known initial access broker (IAB) market domains. It specifically looks for HTTP requests where the host matches 'exploit.in', 'xss.is', 'raidforums', or 'breachforums' and the URI contains the word 'access'. This indicates potential activity related to purchasing or selling initial access to compromised systems.
This rule detects HTTP traffic where the client body contains the terms "rdp" and "buy" (case-insensitive). This combination suggests a potential attempt to purchase RDP access, possibly on an underground forum, which is a policy violation.
This rule detects suspicious access to domain registration services by monitoring HTTP traffic for requests to known domain registrars (namecheap.com, godaddy.com, porkbun.com) with a URI containing 'register'. A threshold of 5 such requests within 60 seconds from the same source IP triggers an alert, indicating potential resource development activity such as bulk domain registration.
This rule detects unauthorized DNS server responses originating from external hosts. Specifically, it looks for UDP traffic on port 53 (DNS) with a specific content signature '|84 00|' at an offset of 2 bytes and a depth of 2 bytes, which corresponds to a DNS response header indicating a standard query response. The rule uses a threshold to alert if 10 such responses are observed from the same source within 30 seconds, suggesting a potential unauthorized or malicious DNS activity.
Page 179 of 211