Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,348 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects the presence of a large Base64 encoded string (at least 100 characters) within the HTTP client body of network traffic. This pattern is often used by attackers to obfuscate malicious payloads, aligning with the MITRE ATT&CK technique T1027 for Defense Evasion.
This rule detects potential web shell access by looking for HTTP requests to PHP files that contain a 'cmd=' parameter in the URI. This pattern is commonly used by web shells to execute commands on a compromised web server, aligning with MITRE ATT&CK technique T1505.003 for web shell persistence.
This rule detects a password spraying attack targeting LDAP services. It triggers an alert if there are 50 or more TCP connections to port 389 (LDAP) on the home network within a 60-second window, originating from the same destination IP address. This pattern is indicative of an attacker attempting to authenticate with a small set of passwords against many accounts.
This rule detects internal Server Message Block (SMB) lateral movement attempts. It triggers when there are 10 or more SMB connections (identified by the "|FF|SMB" content signature) from a single source IP address to any destination on port 445 within a 60-second window, within the home network. This behavior is indicative of an attacker attempting to move laterally within a network using SMB.
This rule detects attempts to list processes via a web shell by looking for the string "tasklist" (case-insensitive) in the HTTP URI. This activity is indicative of an attacker using a compromised web server to gain information about the system, specifically process enumeration, which aligns with the MITRE ATT&CK technique T1057 (Process Discovery).
This rule detects potential Global Catalog LDAP enumeration attempts. It triggers when a source IP makes 10 or more TCP connections to destination port 3268 (the default port for Global Catalog LDAP) within a 60-second window. This behavior can indicate an attacker attempting to discover information about users, groups, and computers within an Active Directory environment.
This rule detects DNS queries for 'pastebin.com'. This activity is often associated with Command and Control (C2) communication, where attackers use services like Pastebin to host malicious code, configuration data, or receive commands. The rule triggers if 10 such queries are observed from the same source IP within a 300-second (5-minute) window, indicating potential C2 activity or data exfiltration attempts.
This rule detects TCP connections to port 8888, which is commonly used by Remote Access Trojans (RATs) for Command and Control (C2) communications. The rule specifically looks for the SYN flag in the TCP handshake, indicating the initiation of a new connection from the internal network ($HOME_NET) to any external destination.
This rule detects network connections to TCP port 4444, which is a commonly used default handler port for Metasploit, a popular penetration testing framework. The rule specifically looks for the initial SYN packet (flags:S) of a TCP connection from any source to any destination on port 4444 within the home network. This activity is often associated with command and control (C2) communication or reverse shells established by attackers using Metasploit.
This rule detects the download of executable files (such as .exe, .dll, .bat, .ps1, .vbs, .hta) over HTTP. It specifically looks for the 'MZ' header, which is characteristic of Windows executables, and checks the HTTP URI for common executable file extensions. This activity is often associated with initial access or command and control techniques where adversaries download malicious payloads.
Page 210 of 211