Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,352 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects a full privileged port range scan. It triggers an alert if a source IP sends 200 TCP SYN packets to ports 0-1024 on the home network within a 10-second window. This behavior is indicative of an attacker attempting to discover open services on well-known ports.
This rule detects attempts to discover the 'security.txt' file on a web server. The 'security.txt' file is a proposed standard for security researchers to easily find contact information for reporting security vulnerabilities. Attackers or reconnaissance tools might look for this file to identify potential targets or gather information about an organization's security posture.
This rule detects potential career page scraping activity, which could be an indicator of reconnaissance by an attacker. It triggers when a client makes 15 or more HTTP requests containing 'careers' in the URI within a 30-second window, suggesting automated or rapid browsing of career-related pages.
This rule detects bulk access to web pages containing the term 'press' in their URI, indicating potential business intelligence gathering or reconnaissance activity. It triggers an alert if a single source IP makes 20 or more such requests within a 30-second window.
This rule detects a timing reconnaissance attempt against a web server, specifically looking for repeated HTTP requests to URIs containing both 'news' and 'events' (case-insensitive). The threshold of 20 requests within 30 seconds from the same source IP suggests an automated or rapid enumeration attempt to potentially infer information about the web server's response times or content availability.
This rule detects a potential client portfolio page enumeration by monitoring HTTP requests. It triggers an alert if a client makes 15 or more requests containing the string "clients" (case-insensitive) in the HTTP URI within a 30-second window. This behavior is indicative of an attacker attempting to discover or enumerate client-related pages or resources on a web server, possibly as part of a reconnaissance effort.
This rule detects repeated HTTP requests to a web server where the URI contains the case-insensitive string "headquarters". It triggers an alert if a single source IP makes 10 such requests within a 30-second window. This behavior is indicative of an automated attempt to scrape information related to a company's headquarters address, potentially for reconnaissance purposes.
This rule detects attempts to look up physical office locations via web requests. It specifically triggers on HTTP GET requests where the URI contains both 'office' and 'location' (case-insensitive). A threshold of 10 such requests from the same source within 30 seconds is set to reduce false positives.
This rule detects HTTP responses from a server to a client that contain specific keywords ('remote', 'support', 'download') within the file data, indicating a potential fake IT support page attempting to deliver a remote access tool. The rule also checks for a minimum file size to reduce false positives.
This rule detects outbound TCP connections to port 9050, which is commonly used by Tor proxies. The rule specifically looks for the initial SYN packet (flags:S) of a TCP connection from the home network to any destination on port 9050. This activity is flagged as a policy violation, indicating the use of a Tor proxy for accessing closed source resources.
Page 204 of 211