Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,357 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects ICMP (Internet Control Message Protocol) packets that are characteristic of a traceroute operation, specifically those with a Time-To-Live (TTL) value less than 5. Traceroute is a network diagnostic tool used to display the route and measure transit delays of packets across an Internet Protocol (IP) network. Adversaries can use this technique for network topology discovery to map out the network infrastructure.
UDP Traceroute Network Discovery
Suricata
This rule detects UDP traceroute network discovery attempts. It triggers an alert when UDP packets with a Time-To-Live (TTL) value less than 5 are observed, with a threshold of 10 such events from the same source within 10 seconds. This behavior is indicative of network scanning to map network topology.
This rule detects attempts to access directory listings on a web server via HTTP. It specifically looks for HTTP responses containing the string "Index of /" in the file data, which is a common indicator of an exposed directory listing. This exposure can allow attackers to discover sensitive files and directories on the server.
This rule detects HTTP requests attempting to access the AWS EC2 Instance Metadata service, specifically targeting the 'latest/meta-data' endpoint. This service, typically found at the IP address 169.254.169.254, provides information about the running EC2 instance, including credentials and other sensitive data. Unauthorized access to this endpoint can indicate an attacker attempting to gain further access or information within an AWS environment.
This rule detects the transmission of cleartext credentials over Telnet by looking for the string "Password:" in traffic flowing to the server on port 23. Telnet is an insecure protocol that sends data, including login credentials, in plain text, making it vulnerable to eavesdropping.
This rule detects the transmission of cleartext credentials over FTP by looking for the "PASS " string in network traffic flowing to an FTP server on port 21. This indicates that a password is being sent without encryption, which is a security risk.
SMB Authentication Brute Force
Suricata
This rule detects SMB authentication brute force attempts by looking for multiple NTLMSSP_AUTH messages over port 445 (SMB) from the same source IP within a 30-second window. A threshold of 10 attempts triggers the alert, indicating a potential brute force attack against SMB authentication.
This Suricata rule detects potential data exfiltration of password store information over HTTP. It specifically looks for HTTP POST requests where the client body contains both the words "password" and "username" (case-insensitive) and the body size is greater than 1000 bytes. This pattern suggests an attempt to send sensitive credential data from a compromised system to a remote server.
This rule detects the download of a Meterpreter reverse shell stage by looking for a specific byte sequence ('|fc e8 8f 00 00 00|') in TCP traffic flowing to the server on an established connection. This byte sequence is characteristic of the initial stage of a Meterpreter payload, which is often used for command and control.
Cobalt Strike DNS Beacon Pattern
Suricata
This rule detects a specific pattern associated with Cobalt Strike DNS beacons. It looks for HTTP requests where the URI contains '/updates' and the User-Agent header is 'Mozilla/4.0'. This combination of indicators is often used by Cobalt Strike for command and control communication.
Page 186 of 211