Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,357 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to discover the current user via a web shell by looking for HTTP requests containing the string "whoami" in the URI. This is a common command executed on compromised web servers to gain information about the user context of the web server process.
This rule detects DNS queries to specific domains (connectivitycheck.gstatic.com or msftconnecttest.com) that are commonly used by operating systems and applications to check for internet connectivity. A high volume of such queries (threshold of 10 within 30 seconds from a single source) could indicate a network scan or unusual network activity.
This rule detects a high volume of Registry Hive bulk queries for system reconnaissance activities. Specifically, it looks for 30 or more 'RegEnumKey' operations over TCP port 445 (SMB) within a 30-second window, originating from a single source IP address and directed towards the protected network. This behavior can indicate an attacker attempting to enumerate registry keys to gather information about the system.
This rule detects attempts to enumerate application windows using specific API calls (EnumWindows and GetWindowText) over HTTP. This behavior is often associated with remote access tools or malware trying to gather information about the user's active applications.
This rule detects attempts to query the list of services on a remote Windows host via the Remote Registry service. It specifically looks for the string "HKLM\System\CurrentControlSet\Services" over TCP port 445 (SMB/CIFS), which is commonly used for Remote Registry access. A threshold of 10 occurrences within 30 seconds from the same source IP is set to reduce false positives.
This rule detects attempts to enumerate Docker containers via the Docker API by looking for HTTP requests containing the URI '/containers/json'. This activity could indicate an attacker performing reconnaissance on a compromised host to understand the running container environment.
This rule detects attempts to enumerate security products on a target system via Remote WMI over SMB (port 445). It specifically looks for the string "AntiVirusProduct" in TCP traffic directed to port 445, indicating a potential query for installed antivirus software. This activity is often associated with discovery tactics used by attackers to understand the security posture of a compromised system or network.
This rule detects attempts to discover password policy information by executing the 'net accounts' command via a web shell. The rule specifically looks for HTTP requests where the URI content contains 'net accounts' in a case-insensitive manner, indicating a potential web-based command execution to gather system information related to password policies.
This rule detects HTTP requests to the AWS EC2 service (ec2.amazonaws.com) that specifically attempt to enumerate Amazon Machine Images (AMIs) using the 'DescribeImages' API call. This activity could indicate an attacker performing reconnaissance to understand the available virtual machine images within an AWS environment.
This rule detects attempts to enumerate Linux system logs via remote SSH connections. Specifically, it looks for the string "cat /var/log/" within TCP traffic on port 22 (SSH). A threshold of 10 occurrences within 30 seconds from the same source IP is set to reduce false positives.
Page 192 of 211