Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,355 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Detects deployment of malicious LaunchDaemon plist files for privileged persistence
Detects blocking of security product reporting to impair defensive capabilities
Detects payloads that check domain membership before executing
Detects manipulation of financial transaction data for financial theft
Detects fake security alert pages used for social engineering attacks
Detects evil twin access point credential capture portal
Detects creation of hidden user accounts via SpecialAccounts registry key
This rule detects DNS queries for domains that exhibit characteristics of Domain Generation Algorithms (DGAs). Specifically, it looks for DNS queries where the queried domain consists of a random-looking subdomain (12 to 24 lowercase alphanumeric characters) followed by common top-level domains such as .com, .net, .org, .info, or .biz. The rule uses a thresholding mechanism to trigger an alert if 10 such queries are observed from the same source IP within a 60-second window, indicating potential DGA activity often associated with botnets or malware for command and control.
Detects access to Group Policy Preferences files with encrypted passwords
Detects bulk domain group membership enumeration via LDAP
Page 18 of 211