Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,356 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to modify or delete Multi-Factor Authentication (MFA) provider configurations via the Microsoft Graph API. Specifically, it looks for HTTP DELETE requests to 'graph.microsoft.com' with a URI containing 'authentication'. This activity could indicate an attacker attempting to disable or alter MFA settings to gain unauthorized access or maintain persistence.
This rule detects attempts to block defender access by holding a file or resource lock. Specifically, it looks for TCP traffic on port 445 (SMB) containing the string "LockFile" in a case-insensitive manner. A threshold of 10 occurrences within 10 seconds from the same source IP is set to trigger an alert, indicating potential malicious activity aimed at hindering security software.
This rule detects attempts to change the power plan on a system via a remote web shell. It specifically looks for HTTP requests containing 'powercfg' and 'setactive' in the URI, indicating the use of the 'powercfg /setactive' command, which is used to change the active power scheme. This activity suggests an attacker might be trying to manipulate system power settings, potentially for persistence or to interfere with system operations.
This rule detects the delivery of a potential autostart payload as a startup script over HTTP. It looks for HTTP URIs containing keywords like 'startup', 'autostart', or 'autorun' (case-insensitive) and checks the file data for the 'MZ' header, indicating an executable file, within the first 2 bytes of the file content. This combination suggests an attempt to deliver an executable that could be configured for persistence.
This rule detects the creation of a Docker container via the Docker API (port 2375) where the container body content includes the string "cron" (case-insensitive). This could indicate an attempt to establish persistence or schedule malicious tasks within a Docker environment.
This rule detects the download of obfuscated JavaScript code that uses 'eval(String.fromCharCode(' to execute content. This pattern is commonly used by malware to hide malicious scripts, often acting as a stager to download and execute further payloads. The detection specifically targets HTTP responses (flow:to_client) containing this string, indicating a client is receiving such obfuscated code.
This rule detects the delivery of a Node.js reverse shell payload over HTTP. It looks for HTTP responses (flow:to_client) containing the strings "require('net')" and "connect(" (case-insensitive), which are indicative of Node.js code attempting to establish a network connection, often for a reverse shell.
This rule detects the download of a Python script that contains code indicative of operating system command execution. Specifically, it looks for the strings "os.system(" and "subprocess" within HTTP response data, suggesting the script intends to execute system commands.
This rule detects email attachments with VBScript extensions (.vbs, .vbe) delivered via SMTP. It specifically looks for the filename attribute in the email flow to the server, indicating a potential malicious script delivery.
This rule detects the delivery of malicious VBScript macros within Office files over HTTP. It specifically looks for the presence of 'CreateObject' and 'WScript.Shell' strings in the file data, which are commonly used by VBScript macros to interact with the operating system and execute commands.
Page 199 of 211