Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,357 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects a high volume of TCP connection attempts to port 135 (RPC) on the home network. A threshold of 20 connection attempts from a single source within 30 seconds triggers the alert. This pattern can indicate an attempt to exploit RPC services for remote execution, often seen in worm propagation or targeted attacks.
This rule detects DCOM remote execution attempts via the RPC Endpoint Mapper. It specifically looks for TCP traffic to port 135 (RPC Endpoint Mapper) with a specific content signature "|05 00 0b|" within the first 3 bytes of the payload, indicating a DCOM activation request.
This rule detects HTTP POST requests that contain the string "creds" in the URI and have a data size greater than 200 bytes. This pattern is indicative of potential browser credential exfiltration, where an attacker or malicious software attempts to send stolen credentials to a remote server.
Remote LSASS Memory Dump via SMB
Suricata
This rule detects attempts to remotely dump the LSASS process memory over SMB. It specifically looks for the string "lsass.exe" within TCP traffic destined for port 445 (SMB) on the home network. This activity is indicative of an attacker trying to extract credentials from a compromised system.
This rule detects the download of files with names indicative of 'Potato' privilege escalation tools. It specifically looks for HTTP URI patterns containing 'potato' preceded by terms like 'sweet', 'juicy', 'rogue', 'bad', or 'print', case-insensitively. The detection is triggered on HTTP traffic flowing from the server to the client.
This rule detects an attempt to escalate privileges on a system via SSH by looking for the string "sudo su" within an established TCP connection to port 22 (SSH). This indicates a user is trying to switch to the root user or another user with elevated privileges using the sudo command.
This rule detects attempts to drop a DLL file to a network share, specifically targeting the 'ADMIN$' share, which could indicate a DLL hijacking attempt. It monitors SMB traffic on port 445 for established connections and looks for content containing '.dll' and 'ADMIN$' (case-insensitive).
This rule detects RDP credential spraying attempts targeting multiple usernames on a single destination IP address. It triggers an alert if 30 or more RDP connection attempts are made to the same destination within a 60-second window, indicating a potential brute-force or credential-stuffing attack against RDP services.
This rule detects attempts to discover Group Policy information remotely over Server Message Block (SMB). It specifically looks for network traffic on port 445 (SMB) containing the strings "SYSVOL" and "GroupPolicy" (case-insensitive) in the same flow, indicating a potential query for Group Policy objects.
LDAP Password Policy Enumeration
Suricata
This rule detects attempts to enumerate LDAP password policy settings by looking for specific content within TCP traffic on port 389 (LDAP). Specifically, it triggers when it finds "(objectClass=domain)" and "pwdHistoryLength" in a case-insensitive manner within the network flow, indicating a query for password history length attribute of a domain object. This activity is often associated with reconnaissance or discovery phases of an attack.
Page 185 of 211