Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,357 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects potential Google Dorking activity targeting a specific site. It triggers when a client makes 10 or more HTTP requests within 60 seconds to 'google.com' where the URI contains 'site:'. This pattern is indicative of an attacker or reconnaissance tool using Google's search operators to find information about a target domain.
This rule detects potential TLS client configuration fingerprinting activity. It triggers an alert when a client sends 20 or more TLS Server Name Indication (SNI) requests to a server within a 30-second window. This behavior can be indicative of reconnaissance activities where an attacker is attempting to identify services or configurations on a target network by observing TLS handshakes.
This rule detects HTTP requests to a web server that contain both 'firmware' and 'version' in the URI, case-insensitively. This pattern is often associated with attempts to access router firmware version information pages, which could be part of reconnaissance activities.
This rule detects an SNMP Hardware MIB Enumeration Walk. It triggers when a TCP connection to port 161 (SNMP) on the home network contains the byte sequence "30 82" at a depth of 2 bytes. A threshold is set to trigger an alert if 20 such events occur within 30 seconds from the same source IP address. This activity is classified as a network scan, specifically reconnaissance, as it involves querying SNMP for hardware information.
This rule detects attempts to enumerate hardware asset inventory information via web requests. It triggers when HTTP requests contain both 'asset' and 'inventory' in the URI, indicating a potential reconnaissance activity to gather information about an organization's hardware assets. A threshold of 10 such requests within 60 seconds from the same source IP is set to reduce false positives.
This rule detects web path fuzzing activity by identifying the 'dirsearch' string in the HTTP User-Agent header. Dirsearch is a common tool used for discovering web directories and files, often employed in reconnaissance phases of attacks or security assessments.
This rule detects HTTP traffic where the User-Agent header contains the string "Burp" (case-insensitive). This is indicative of traffic generated by Burp Suite, a popular web vulnerability scanner and proxy tool. The rule specifically looks for traffic flowing from the internal network to a server.
High Port Range Scan Detected
Suricata
This rule detects a high port range scan by monitoring TCP connections with the SYN flag set (indicating a new connection attempt) to ports within the high range (1025-65535) on the home network. It triggers an alert if more than 200 such connection attempts are observed from a single source IP address within a 10-second window.
Supplier Chain Page Enumeration
Suricata
This rule detects potential enumeration of supplier-related pages on a web server. It triggers when a client makes 15 or more HTTP requests containing the case-insensitive string "supplier" in the URI within a 30-second window. This behavior could indicate an attacker attempting to discover sensitive information or entry points related to an organization's supply chain.
This rule detects bulk access to the 'about-us' page on a web server. It triggers an alert if a single source IP makes 15 or more HTTP requests containing 'about-us' in the URI within a 30-second window. This behavior can indicate reconnaissance activity, where an attacker is rapidly enumerating or scraping information from a company's public-facing web pages.
Page 181 of 211