Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,357 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects large HTTP POST requests containing GZIP compressed data (identified by the magic bytes '|1F 8B|') with a size greater than 100,000 bytes. This behavior is indicative of possible data staging or exfiltration, where an attacker might compress and upload sensitive data from a compromised system.
Confluence Wiki Bulk Export
Suricata
This rule detects HTTP requests to the '/spaces/exportspace.action' URI, which is associated with bulk export functionality in Confluence Wiki. This activity could indicate an attempt to exfiltrate data from a Confluence instance.
This rule detects a high volume of document downloads from SharePoint, specifically looking for repeated access to the `/_layouts/download.aspx` URI. A threshold of 30 downloads within 60 seconds from a single source IP address triggers the alert. This behavior could indicate an attempt to exfiltrate a large amount of data from SharePoint.
This rule detects attempts to drop executable files (.exe) into shared network folders (specifically those containing '\share\') over SMB (Server Message Block) protocol. This activity is indicative of an attacker attempting to move tools or malware laterally within a network.
This rule detects attempts to enumerate Docker containers via the Docker API. Specifically, it looks for HTTP requests to the '/containers/json' endpoint on TCP port 2375, which is commonly used for unauthenticated Docker API access. This activity is indicative of an adversary trying to discover running containers on a compromised host.
This rule detects a pattern indicative of ransomware encrypting files over SMB. It specifically looks for TCP traffic on port 445 (SMB) within the home network, containing the byte sequence '|FF|SMB'. A threshold of 500 such events from a single source IP within 30 seconds triggers the alert, classifying it as trojan activity.
XOR Encoded C2 Traffic Pattern
Suricata
This rule detects HTTP client body traffic that appears to be XOR encoded, characterized by a long sequence of non-printable ASCII characters (bytes 0x01-0x1f and 0x7f-0xff) of at least 50 characters. This pattern is often indicative of Command and Control (C2) communication used by malware to evade detection.
Bitsadmin Tool Transfer Download
Suricata
This rule detects the use of the 'bitsadmin' tool in HTTP user agent strings during a file transfer download. Bitsadmin is a legitimate Windows command-line tool used to create, manage, and monitor download and upload jobs, but it is frequently abused by adversaries for command and control, data transfer, and persistence.
This rule detects network reconnaissance activity by identifying HTTP requests where the User-Agent header contains the string "masscan". Masscan is a fast internet port scanner, and its User-Agent string often indicates scanning activity, which aligns with the MITRE ATT&CK technique T1595.002 for active scanning during reconnaissance.
This rule detects an SSH brute force attack by monitoring TCP connections to port 22 (SSH) on the home network. It triggers an alert if more than 20 TCP SYN packets are observed from a single source IP address within a 60-second window, indicating a high volume of connection attempts characteristic of a brute force.
Page 187 of 211