Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,358 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects WHOIS queries directed to internal services within the network. It specifically looks for TCP traffic on port 43 (the standard WHOIS port) flowing from any source to the internal network. A threshold of 5 queries within 60 seconds from the same source is set to reduce noise, indicating a potential network scan or reconnaissance activity.
This rule detects potential staff directory scraping by monitoring HTTP GET requests to URIs containing the word "staff". It triggers an alert if more than 20 such requests are observed from a single source IP within a 30-second window, indicating automated or rapid enumeration attempts.
This rule detects potential credential harvesting attempts by monitoring HTTP POST requests that contain both 'password' and 'email' in the client body. It specifically looks for these keywords in a case-insensitive manner within the HTTP client body and requires the body size to be greater than 50 bytes. This indicates a form submission likely containing sensitive user credentials.
Executive Team Page Enumeration
Suricata
This rule detects repeated HTTP requests to URIs containing the word "executive" (case-insensitive) from a single source IP address within a 30-second window. This behavior could indicate an attempt to enumerate executive team pages, potentially for reconnaissance purposes.
This rule detects potential executive leadership directory scraping attempts. It triggers an alert when a client makes 10 or more HTTP requests containing the word "leadership" (case-insensitive) in the URI within a 30-second window. This behavior could indicate an attacker attempting to gather information about key personnel for social engineering or other reconnaissance purposes.
This rule detects enumeration attempts of partner and vendor pages on a web server. It triggers when a client makes 20 or more HTTP requests containing the case-insensitive string "partner" in the URI within a 30-second window, indicating a potential reconnaissance activity to discover sensitive or specific sections of a website.
This rule detects a potential network scan targeting firewall management interfaces. It specifically looks for TCP SYN packets (flags:S) directed to port 8443 on the home network, which is a common port for firewall management. The rule triggers if 5 such connection attempts are observed from the same source within a 60-second window, indicating a threshold-based scan.
This rule detects HTTP requests to known BGP route lookup services (bgp.he.net, bgpview.io, ipwhois.io). This activity is often associated with reconnaissance, specifically IP block discovery, where an attacker or red team member is gathering information about an organization's network infrastructure.
This rule detects network host discovery attempts via UDP sweeps. It triggers an alert when a single source IP sends 30 or more UDP packets within a 10-second window to various destinations on the home network. This behavior is indicative of an attacker attempting to map out active hosts on a network.
Sitemap File Discovery Access
Suricata
This rule detects HTTP requests to URIs that contain both 'sitemap' and '.xml' (case-insensitive). This pattern is commonly associated with the discovery of sitemap files, which are used by search engines to crawl websites. Attackers or reconnaissance tools might access these files to map out a website's structure and discover hidden or unlinked pages, which can then be used for further attacks.
Page 180 of 211