Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,357 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to fingerprint web applications by identifying the 'WhatWeb' string in the HTTP User-Agent header. WhatWeb is a web application scanner that identifies technologies used by websites, which can be an indicator of reconnaissance activity.
This rule detects HTTP responses from a C2 beacon that contain the keywords "kill" and "process" (case-insensitive) within the URI. This pattern suggests a command being sent from the command and control server to the client to terminate a process, potentially an antivirus process, as part of defense evasion tactics.
This rule detects HTTP traffic where the URI contains both 'disable' and 'defender' (case-insensitive). This pattern suggests an attempt to disable security tools, specifically Windows Defender, via an HTTP command. The flow is set to 'to_client,established', indicating the response from a server to a client within an established connection.
This rule detects attempts to remotely clear event logs over Server Message Block (SMB) by looking for the strings "Eventlog" and "ClearEventLog" in TCP traffic destined for port 445. This activity is often associated with adversaries attempting to remove forensic evidence of their presence on a system.
This rule detects network traffic indicative of WMI remote execution, specifically looking for the string "IWbemServices" on TCP port 135. This activity is often associated with Living Off The Land Binaries and Scripts (LOLBAS) techniques, where legitimate system tools like WMI are abused for malicious purposes such as remote code execution or lateral movement. The rule is designed to alert on potential trojan activity.
This rule detects the download of a COM scriptlet (.sct file) over HTTP that contains XML and the keyword 'scriptlet'. This behavior is characteristic of the 'Squiblydoo' technique, which abuses legitimate Windows binaries like Regsvr32 to execute arbitrary code, often for defense evasion.
This rule detects HTTP traffic where the User-Agent header contains the string 'CertUtil' (case-insensitive). This pattern is often associated with adversaries using the Windows built-in utility CertUtil to download malicious payloads, a common technique for defense evasion.
This rule detects HTTP downloads where the file is disguised as an image (e.g., .jpg, .png) but its content starts with 'MZ', indicating it's a Windows executable. This is a common technique used by adversaries to bypass security measures that might block executable downloads but allow image files.
This rule detects when a file is written to a remote Windows Startup folder via Server Message Block (SMB). The rule specifically looks for SMB traffic containing the string "Startup" and "\AppData\Roaming\Microsoft\Windows\" (case-insensitive) in the flow to the server. This activity is often associated with persistence mechanisms where malware or an attacker attempts to execute code automatically upon system startup.
This rule detects attempts to download a payload that contains an MSBuild inline task. It specifically looks for HTTP traffic (flow:to_client,established) containing the case-insensitive strings "<UsingTask" and "TaskFactory" within the file data. This pattern is indicative of an attacker attempting to leverage MSBuild's inline task functionality to execute arbitrary code, often as part of a larger attack chain for code execution or persistence.
Page 184 of 211