Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,348 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This Suricata rule detects potential internal RDP session hijack attempts. It triggers an alert when there are three or more established TCP connections to port 3389 (RDP) on the home network, originating from within the home network, within a 30-second window, tracked by the destination IP address. This pattern could indicate an attacker attempting to take over an existing RDP session or rapidly establish multiple RDP connections internally.
Remote Service Stop via SMB
Suricata
This rule detects attempts to remotely stop a service via SMB (Server Message Block) by looking for the 'svcctl' and 'StopService' strings in TCP traffic on port 445. This activity is often associated with trojan activity or other malicious impact operations.
This rule detects a bulk file copy pattern to a removable share over SMB (port 445). It triggers an alert if there are more than 200 SMB 'to_server' flows from a single source within a 60-second window, indicating a high volume of data transfer. This behavior is often associated with data exfiltration or large-scale data movement to external storage.
This rule detects potential data exfiltration to an AWS S3 bucket. It triggers on HTTP PUT requests to 's3.amazonaws.com' with a payload size greater than 10000 bytes. This could indicate an attacker uploading sensitive data from the internal network to an external S3 bucket they control.
WebDAV File Upload Exfiltration
Suricata
This rule detects potential WebDAV file upload exfiltration attempts by monitoring HTTP traffic for the 'PROPFIND' method. It uses a threshold of 10 occurrences within 60 seconds from the same source IP address to identify suspicious activity, indicating a possible attempt to enumerate or exfiltrate files via WebDAV.
This rule detects potential Secure File Transfer Protocol (SFTP) large file exfiltration attempts. It triggers an alert when a TCP connection on port 22 (SFTP) from the home network to any destination transfers a large amount of data (greater than 65000 bytes) to the server. A threshold of 20 such transfers within 60 seconds from the same source IP is set to reduce false positives. The rule specifically looks for the SFTP protocol magic bytes '|00 00 00|' within the first 4 bytes of the payload.
This rule detects large data exfiltration attempts over SMTP Submission (port 587). It triggers an alert if more than 50,000 bytes of data are sent from a single source IP address to a server via SMTP Submission, with a threshold of 5 such events within a 300-second window. This indicates a potential policy violation related to data exfiltration.
This rule detects large attachments being exfiltrated via SMTP. Specifically, it looks for SMTP traffic on port 25, flowing to the server, that contains the 'Content-Transfer-Encoding: base64' header and has a data size greater than 50,000 bytes. This combination suggests a large, base64-encoded file being sent as an email attachment, which could indicate data exfiltration.
This Suricata rule detects C2 port hopping behavior by identifying a single source IP initiating 10 or more TCP SYN packets to different non-standard ports within a 30-second window. This pattern is indicative of command and control (C2) communication attempting to evade detection by frequently changing ports.
This rule detects network reconnaissance activity by identifying HTTP user-agent strings commonly associated with vulnerability scanners like Nmap or Masscan. It specifically looks for the string 'Nmap' within the HTTP user-agent header in traffic flowing from the internal network to a server.
Page 208 of 211