Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,357 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects suspicious DNS lookups for 'pastebin.com'. It triggers an alert if a source IP performs 5 or more DNS queries for 'pastebin.com' within a 60-second window. This activity is often associated with reconnaissance, as attackers may use Pastebin to host command and control (C2) information, exfiltrated data, or other malicious content.
This rule detects unauthenticated access attempts to the Docker Daemon API, specifically targeting TCP port 2375. It triggers on the initial SYN packet of a TCP connection to this port, indicating an attempt to establish a connection to the Docker API without authentication. This activity is often associated with privilege escalation attempts, as an unauthenticated Docker API can be exploited to gain control over the host system.
This rule detects the creation of remote scheduled tasks over SMB by looking for the string "schtasks" in TCP traffic destined for port 445 (SMB). This activity is often associated with persistence techniques where attackers establish scheduled tasks on remote systems.
This rule detects HTTP web requests that contain the string "cmd.exe" in the URI, indicating an attempt to execute a command shell via a web request. This is often associated with web application attacks where an attacker tries to leverage a vulnerability to run system commands.
This rule detects HTTP requests where the URI contains the string "-EncodedCommand" case-insensitively. This pattern is commonly associated with PowerShell commands that are base64 encoded, often used by attackers to obfuscate malicious scripts. The rule specifically looks for this string in the HTTP URI, indicating an attempt to download or execute an encoded PowerShell command.
This rule detects HTTP requests that contain patterns indicative of a PowerShell download cradle. Specifically, it looks for 'powershell' and 'IEX' (Invoke-Expression) within the HTTP URI, suggesting an attempt to download and execute a script using PowerShell.
This rule detects attempts to execute the Unix shell '/bin/bash' via HTTP requests. Specifically, it looks for the string '/bin/bash' within the URI of HTTP traffic flowing to the server. This could indicate an attacker attempting command injection or other web-based exploitation to gain shell access.
This rule detects network service scanning activity by identifying a high volume of TCP SYN packets (flags:S) from a single source IP address to multiple destinations within the HOME_NET over a short period. Specifically, it triggers if 50 or more SYN packets are observed from the same source within 10 seconds. This behavior is indicative of an attacker attempting to discover open ports and services on internal network hosts, a common reconnaissance technique.
This rule detects a potential SSH password brute force attack. It triggers an alert if there are 30 or more TCP connections to port 22 (SSH) on the home network from a single source IP address within a 60-second window. The 'flow:to_server' and 'flags:S' indicate that it's looking for new connection attempts (SYN packets) directed towards the server.
This rule detects potential DNS tunneling activity by identifying DNS queries with high entropy subdomains. Specifically, it looks for subdomains that consist of 30 or more alphanumeric characters (a-z, 0-9). A threshold is applied, triggering an alert if 5 such queries are observed from the same source IP within a 60-second window. This pattern is often indicative of data exfiltration or command and control communication over DNS.
Page 188 of 211