Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,357 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects when a network device disables hardware crypto acceleration. It specifically looks for TCP traffic on port 22 (SSH) from any source to the home network, containing the case-insensitive string "no crypto engine". This could indicate a policy violation or an attempt to degrade cryptographic performance, potentially for evasion or to facilitate other attacks.
This rule detects the negotiation of a weak cipher, specifically 'arcfour', during an SSH session. It monitors TCP traffic flowing to the home network on port 22 (SSH) and triggers an alert if the string 'arcfour' is found in the established session, ignoring case.
This rule detects when an AWS Organization Unit (OU) is modified, specifically when the 'MoveAccount' API call is made to 'organizations.amazonaws.com'. This activity could indicate an attempt to evade detection or alter the organizational structure for malicious purposes.
This rule detects the delivery of a payload that attempts to use rundll32.exe for proxy execution. It specifically looks for HTTP traffic (flow:to_client,established) containing both "rundll32.exe" and ".dll," (case-insensitive) in the file data, indicating a potential malicious DLL being delivered for execution via rundll32.
This rule detects attempts to modify the Info.plist file on macOS systems to include 'LSUIElement' with a value of '<true/>'. This modification can be used by malware or unwanted applications to hide their presence from the macOS Dock and menu bar, effectively bypassing user detection and making the application run as a background process. The rule specifically looks for these two content strings within HTTP file data flowing to the client.
This rule detects HTTP traffic where the URI contains both 'odbcconf' and 'REGSVR' (case-insensitive). This combination is indicative of an attempt to use odbcconf.exe for DLL proxy execution, a technique often employed by adversaries for defense evasion.
This rule detects HTTP traffic where the User-Agent header contains "MSHTML", indicating potential remote script execution via Mshta. Mshta.exe is a Microsoft utility that can execute HTML Application (HTA) files, which can contain scripts. Attackers often abuse Mshta to execute malicious scripts, bypassing traditional execution policies. The rule specifically looks for outbound HTTP connections from the internal network ($HOME_NET) to any external destination, where the User-Agent string includes "MSHTML" (case-insensitive). This behavior is commonly associated with trojan activity and defense evasion tactics.
This rule detects the string "CheckRemoteDebuggerPresent" within HTTP response payloads. This string is associated with an anti-debugging technique used by malware to detect if it's being analyzed in a debugger environment. The rule specifically looks for this content in data flowing from the server to the client (flow:to_client,established; file.data;). The detection is case-insensitive (nocase).
This rule detects the delivery of an HTA (HTML Application) file via HTTP. It specifically looks for HTTP responses containing a URI with the '.hta' extension (case-insensitive) and the content '<HTA:APPLICATION' (case-insensitive) within the file data, indicating an HTA application being served to a client. This technique is often used by attackers for defense evasion and initial access.
This rule detects attempts to dump the LSASS process memory remotely over SMB. It specifically looks for network traffic on TCP port 445 (SMB) containing the string "lsass.dmp" in a case-insensitive manner, indicating a potential credential dumping activity.
Page 195 of 211