Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,357 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects outbound TCP connections from any source to the local network ($HOME_NET) on port 9150. This port is commonly used by Tor Browser for its SOCKS proxy, indicating potential use of Tor for anonymization or to bypass network restrictions. The rule specifically looks for the SYN flag in the TCP handshake, signifying the initiation of a connection.
This rule detects outbound TCP connections from any source to the local network ($HOME_NET) on port 9050, specifically looking for the SYN flag. Port 9050 is commonly associated with Tor SOCKS proxy services. This activity is classified as a policy violation and is linked to the MITRE ATT&CK technique T1090.003, which involves using a Tor proxy for defense evasion.
This rule detects a high volume of IMAP/SSL connections to port 993 from a single source IP address within a short timeframe, which could indicate an attempt to collect emails in bulk, potentially associated with MITRE ATT&CK technique T1114 (Email Collection). The threshold is set to 30 connections within 60 seconds from the same source.
This rule detects attempts to establish a WinRM HTTPS connection (port 5986) to a host on the home network. It specifically looks for TCP SYN packets (flags:S) and triggers if three such connection attempts are made from the same source within 60 seconds. This pattern can indicate lateral movement activity using WinRM over HTTPS.
This rule detects potential data exfiltration to Dropbox cloud storage. It specifically looks for HTTP POST requests to 'api.dropboxapi.com' with a data size greater than 5000 bytes, indicating a significant upload.
This rule detects large HTTP POST requests originating from the internal network ($HOME_NET) to any external destination. It specifically looks for HTTP POST methods and a data size greater than 10,000 bytes. A detection filter is applied to track by source IP, triggering an alert if 20 such large POST requests are observed within a 60-second window. This behavior is indicative of potential data exfiltration over command and control (C2) channels, as large amounts of data are being sent out of the network.
This rule detects HTTP downloads of common script file types (PowerShell, VBScript, JavaScript, HTML Application, Batch, Command) from any source to the internal network. This activity is often associated with initial access or execution techniques where adversaries download malicious scripts to a compromised host.
This rule detects HTTP C2 beaconing activity characterized by regular interval GET requests. It specifically looks for 20 GET requests within a 60-second window from the same source IP address to any destination. This pattern is indicative of command and control communication, often used by malware to check in with its operators.
This rule detects DNS queries for known cryptomining pool domains. It specifically looks for patterns like 'pool.monero', 'pool.xmr', 'pool.minexmr', 'pool.nanopool', and 'pool.supportxmr' within DNS queries, indicating potential cryptomining activity on the network.
This rule detects DNS queries for domains ending with '.onion', which are typically associated with the Tor network. In the context of ransomware, this pattern can indicate communication with Command and Control (C2) servers hosted on the dark web, often used for exfiltration or receiving further instructions.
Page 189 of 211