Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,352 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to access known online platforms used for purchasing stolen data, such as 'leakbase', 'breachforums', and 'raidforums'. It specifically looks for these keywords in the HTTP host header during client-to-server HTTP traffic.
This rule detects access to known exploit kit purchase or dark web marketplace sites by inspecting HTTP host headers for specific domain patterns. The rule triggers an alert if a client on the home network attempts to connect to any of the listed domains, which are associated with exploit kit sales or underground forums.
This rule detects HTTP responses that appear to be a phishing kit landing page. It looks for specific keywords in the HTTP response body, such as 'img', 'logo', 'password', and 'Submit', indicating a page designed to collect credentials. Additionally, it checks if the HTTP host is an IP address, which is often used in phishing campaigns to bypass domain-based reputation checks or to host pages directly on compromised servers.
This rule detects potential phishing emails sent over SMTP that request sensitive information. It looks for specific keywords in the email subject and content, such as "verify", "account", and "click here", indicating an attempt to trick the recipient into revealing credentials or other sensitive data.
This rule detects HTTP POST requests where the client body contains the keywords 'company', 'role', and 'email' (case-insensitive). This combination of keywords in a POST request body is indicative of a phishing reconnaissance attempt, where an attacker is trying to collect organizational data through a form submission.
This rule detects bulk phishing campaign delivery by monitoring SMTP traffic for a high volume of emails containing the 'Subject:' header. Specifically, it triggers an alert if 20 or more emails with a 'Subject:' header are sent to the internal network (HOME_NET) on port 25 within a 60-second window from the same source.
This rule detects HTTP responses that contain content indicative of a survey lure page used for information gathering. It specifically looks for the presence of keywords such as 'survey', 'name', 'email', and 'company' within the HTTP response body, suggesting an attempt to collect personal or organizational information.
This rule detects potential credential phishing pages served to a user over HTTP. It looks for HTTP responses containing both "Enter your password" and "Sign in" (case-insensitive) in the file data, and where the HTTP host is an IP address rather than a domain name. This combination of indicators suggests a generic phishing attempt designed to trick users into providing their credentials.
This rule detects HTTP requests to domains associated with corporate intelligence subscription services such as Dun & Bradstreet (dun.com, dnb.com) and Hoovers (hoovers.com). It triggers an alert if a single source IP makes 10 or more such requests within a 60-second window, indicating potential reconnaissance activity.
This rule detects HTTP requests to known data broker websites such as Spokeo, Intelius, and BeenVerified. It triggers an alert if 10 or more such requests are observed from a single source IP within a 60-second window. This activity could indicate reconnaissance efforts to gather information about individuals.
Page 205 of 211