Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,357 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects network connections to known exploit sales platforms such as exploit.in, 0day.today, and leakbase. It specifically looks for HTTP traffic where the host header matches one of these domains, indicating potential access to marketplaces for exploits and zero-day vulnerabilities.
This rule detects HTTP requests that appear to be credential phishing attempts, specifically looking for pages that might also attempt to bypass multi-factor authentication (MFA). It triggers when an HTTP URI contains the keywords "token", "verify", and "auth" (case-insensitive). This combination of keywords in the URI suggests a page designed to collect credentials and potentially an MFA bypass token.
This rule detects bulk scraping of 'team' or 'roles' pages on a web server. It triggers an alert if a client makes 15 or more HTTP requests containing 'team' (case-insensitive) in the URI within a 30-second window. This behavior is indicative of reconnaissance activities, specifically collecting information about an organization's structure or personnel.
This rule detects the download of common Remote Access Tools (RATs) such as AnyDesk, TeamViewer, UltraViewer, RustDesk, and Zoho Assist. It specifically looks for these keywords in the HTTP URI during client-to-server HTTP traffic. The rule is categorized as 'trojan-activity' and is intended to alert when a user might be downloading these tools, potentially after social engineering or phone contact, as suggested by the rule's message.
This rule detects attempts to access typosquatted domains commonly used in phishing attacks. It specifically looks for HTTP requests where the host header contains variations of popular brand names like 'microsoft', 'google', 'paypal', 'amazon', and 'linkedin' with common typos (e.g., 'micros0ft', 'g00gle', 'paypa1', 'arnazon', 'linkedln'). The rule triggers on established HTTP connections to the server.
This rule detects HTTP traffic where the HTTP referer header indicates a social media platform (LinkedIn, Twitter, Facebook, Instagram) and the HTTP URI contains the string 'login'. This combination suggests a potential social media phishing attempt, where a user is redirected from a legitimate social media site to a credential harvesting page.
This rule detects potential scraping activity targeting LinkedIn job listings. It triggers an alert when a single source IP makes 20 or more HTTP requests to 'linkedin.com' with a URI containing '/jobs/' within a 60-second window. This behavior could indicate an automated script or tool attempting to collect job information for various purposes, including competitive intelligence, data aggregation, or reconnaissance.
This rule detects enumeration of job listing pages on web servers, likely for tech stack reconnaissance. It triggers when a client makes 15 or more HTTP requests containing 'jobs' in the URI within a 30-second window to the same server. This behavior can indicate an attacker attempting to gather information about an organization's technology stack by analyzing job descriptions, which often mention specific software, systems, or programming languages.
This rule detects HTTP requests to known underground forums (nulled.to, hackforums.net, ogusers) via a clearnet proxy. It specifically looks for these hostnames in HTTP traffic.
This rule detects potential reconnaissance activity involving scraping LinkedIn company overview pages. It triggers when a client makes 10 or more HTTP requests to 'linkedin.com' with a URI containing '/about/' within a 60-second window. This pattern suggests automated or rapid collection of public company information from LinkedIn.
Page 182 of 211