Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,356 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects the delivery of a tool capable of dumping LSASS memory over HTTP. It specifically looks for the string "MiniDumpWriteDump" within HTTP response data, which is a function commonly used by tools to extract credentials from the LSASS process.
This rule detects attempts to modify file permissions remotely via SMB by looking for the string "icacls" in TCP traffic directed to port 445 (SMB). The detection is case-insensitive and focuses on established connections flowing to the server. This activity is classified as trojan activity, suggesting an attacker might be attempting to alter file access controls on a remote system.
This rule detects attempts to modify an Azure Management Group, specifically when a PUT request is made to 'management.azure.com' with 'managementGroups' in the URI. This activity could indicate an attempt to evade defenses by altering management group configurations.
This rule detects network activity associated with password cracking tools like Hashcat or John the Ripper. It specifically looks for HTTP user agent strings containing "hashcat" or "john.the.ripper" in traffic flowing to a server.
This rule detects the delivery of a payload containing the strings "SpAcceptCredentials" and "hook" within HTTP response body data. This pattern is indicative of an SSPI credential hooking attempt, where an attacker tries to intercept or steal credentials by injecting malicious code into the Security Support Provider Interface (SSPI) process. The detection is focused on traffic flowing from the server to the client.
This rule detects the presence of an API hooking payload within HTTP response data, specifically looking for the strings "SetWindowsHookEx" and "WH_KEYBOARD" (case-insensitive). This combination suggests an attempt to intercept keyboard input, which is a common technique used by malware for credential interception.
This rule detects potential keylogger data exfiltration over HTTP POST requests. It specifically looks for HTTP POST requests where the URI contains the string 'keys' (case-insensitive) and the data size is greater than 200 bytes. This combination suggests that a keylogger might be sending captured keystrokes or other sensitive data to a remote server.
This rule detects attempts to access SSH private key files (id_rsa, id_dsa, id_ecdsa, or .pem files) via HTTP. It specifically looks for these file extensions or names in the HTTP URI, indicating a potential exposure of sensitive SSH credentials on a web server.
This rule detects HTTP requests for the '.env' file, which often contains sensitive environment variables and credentials. An attacker successfully retrieving this file could gain access to critical system information, API keys, database credentials, and other secrets, leading to further compromise. The rule specifically looks for the string '/.env' in the HTTP URI, indicating an attempt to access this configuration file.
This rule detects the exfiltration of AWS temporary credential tokens over HTTP. It specifically looks for HTTP client body content containing both "ASIA" (which is a common prefix for AWS temporary access keys) and "aws_session_token" (the parameter name for the session token). The detection is case-insensitive and targets established HTTP connections where data is flowing from the client to the server.
Page 196 of 211