Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,352 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects a potential watering hole attack where a legitimate website has been injected with a script that attempts to load content from an IP address. Specifically, it looks for HTTP responses (flow:to_client) containing '<script src=' followed by a URL where the source is an IP address (e.g., 'src="http://1.2.3.4/script.js"'). This technique is often used by attackers to compromise visitors of a trusted site by redirecting them to malicious content or exploiting vulnerabilities.
This rule detects potential drive-by exploit kit landing pages by inspecting HTTP response data for the presence of both "exploit" and "shellcode" (case-insensitive). It specifically looks for these keywords in the data flowing from the server to the client over an established HTTP connection. The rule is categorized as an exploit-kit detection and is associated with MITRE ATT&CK technique T1189 (Drive-by Compromise) and tactic Initial Access.
This rule detects potential rogue captive portal credential harvesting pages by inspecting HTTP responses for the presence of keywords like 'captive', 'password', and 'connect' within the file data. These keywords, when found together in a client-bound HTTP response, suggest an attempt to mimic a legitimate captive portal to steal user credentials.
This rule detects attempts to capture credentials via an 'Evil Twin' access point by looking for HTTP POST requests to URIs containing both 'login' and 'wifi'. This combination suggests a malicious captive portal designed to trick users into submitting their credentials.
This rule detects potential DNS hijacking attempts via a compromised resolver. It specifically looks for UDP traffic on port 53 (DNS) to the home network, containing the DNS response code '81 80' (indicating a standard query response) and the PCRE pattern '/\x00\x01\x00\x00/' which corresponds to a single question in the DNS query. A threshold of 20 occurrences within 10 seconds from the same source IP triggers the alert, suggesting a high volume of suspicious DNS responses.
This rule detects a high volume of outbound TCP communication from the home network to any destination on port 8080. This pattern can indicate a compromised server acting as a proxy or engaging in other suspicious network activity, potentially for resource development or command and control.
This rule detects potential command and control (C2) activity where a compromised WordPress site is used as a relay. It specifically looks for HTTP POST requests to URIs containing "wp-admin" with a data size greater than 1000 bytes. A threshold of 5 such events within 60 seconds from the same source IP triggers the alert, indicating a potential high volume of C2 communication.
This rule detects attempts to sell or exchange VPN credentials by looking for the keywords "vpn" and "credentials" in the client body of HTTP traffic. This could indicate an attacker attempting to monetize stolen VPN access or an insider threat attempting to leak sensitive access information.
This rule detects potential employee directory enumeration attempts via web requests. It triggers when HTTP URI content contains both 'directory' and 'people' (case-insensitive) within a 60-second window from the same source IP, with a threshold of 10 occurrences. This behavior is indicative of an attacker attempting to discover employee information or organizational structure.
This rule detects potential email address harvesting via web scraping by identifying a high volume of HTTP GET requests to URIs containing the word "contact" within a short timeframe from a single source IP address. The threshold is set to 30 requests within 30 seconds, indicating automated or rapid access attempts often associated with scraping activities.
Page 202 of 211