Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,348 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects a payload download after a redirect chain, which is a common technique used in user execution attacks. It specifically looks for HTTP responses containing a redirect pattern in the HTTP referer and then checks for the 'MZ' magic bytes (indicating a Windows executable) in the file data within a short depth. This suggests a user being redirected and then automatically downloading a malicious executable.
This rule detects the download of files that have a 'double extension' pattern, specifically where a common document or image file extension (pdf, doc, jpg, png) is followed by an executable extension (exe, bat, vbs, ps1). This pattern is often used by attackers to trick users into executing malicious files, as the operating system might only display the first extension, making the file appear benign. The detection is based on analyzing the HTTP URI for this specific naming convention.
This rule detects suspicious executable downloads from email-related referers. It specifically looks for HTTP traffic where the referer header contains keywords like 'mail.', 'webmail.', 'outlook.', 'gmail.', or 'yahoo.com', indicating the download originated from an email client or webmail interface. The rule further narrows down the detection to files containing the 'MZ' header (characteristic of Windows executables) with a size greater than 10000 bytes, suggesting a potential malicious executable being delivered via email.
This rule detects HTTP traffic containing the string "duckyScript" in the file data, indicating a potential payload delivery page associated with OMG Cables or Rubber Ducky devices. These devices are often used for injecting malicious keystrokes or other payloads.
This rule detects potential cloud API access using a stolen token by monitoring HTTP requests to AWS S3, Azure management, or Google APIs that contain an 'Authorization: Bearer' header. A threshold of 50 such requests within 10 seconds from the same source IP triggers the alert, indicating a possible brute-force or high-volume access attempt with a compromised token.
This rule detects HTTP POST requests to common cloud console login pages (AWS, Microsoft Azure, Google Cloud) that originate from a suspicious IP range. The rule uses a threshold of 5 attempts within 30 seconds from the same source IP to trigger an alert, indicating potential brute-force or credential stuffing attacks against cloud accounts.
This rule detects VNC (Virtual Network Computing) remote access sessions initiated from any source IP address to any IP address within the local network ($HOME_NET) on port 5900. It specifically looks for the 'RFB 00' string within the first 7 bytes of the TCP payload, which is characteristic of the VNC protocol handshake. A threshold is applied to trigger an alert if 3 such connections are observed from the same source IP within a 60-second window, indicating potential repeated or sustained VNC activity.
This rule detects suspicious software installers being downloaded over HTTP. It looks for HTTP responses containing the 'MZ' header (indicating a Windows executable) with a file size greater than 1MB, and where the HTTP URI contains keywords like 'setup', 'install', or 'update'. The rule is thresholded to trigger if three such events occur from the same source within 60 seconds, aiming to identify potential malware or unwanted software distribution.
This rule detects the download of potentially trojanized software updates. It specifically looks for HTTP traffic flowing to the client, where the URI contains "update" (case-insensitive), the HTTP host contains "update.", "cdn.", or "download." (case-insensitive), and the file data starts with "MZ" (indicating a Windows executable) within the first 2 bytes. Additionally, the downloaded file size must be greater than 500,000 bytes.
This rule detects attempts to download Python packages from the official Python Package Index (PyPI) where the package name in the URI appears to be a typosquatted version of common legitimate packages. Specifically, it looks for HTTP requests to pypi.org with URIs containing 'requets' (instead of 'requests'), 'boto' (instead of 'boto3' or similar), 'djang0' (instead of 'django'), 'flask2' (instead of 'flask'), or 'numpy2' (instead of 'numpy'). This indicates a potential supply chain attack where an attacker has registered a similarly named malicious package to trick users into downloading it.
Page 201 of 211