Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,348 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects a high rate of DNS queries originating from a single source IP address within a specified time frame, which can be indicative of DNS Command and Control (C2) beaconing activity. Specifically, it triggers an alert if a source IP makes 50 or more DNS queries within a 60-second window. This behavior is often associated with malware attempting to communicate with a C2 server by encoding data within DNS requests or using DNS as a covert communication channel.
This rule detects potential audio stream exfiltration using the Real-time Transport Protocol (RTP). It specifically looks for UDP traffic with a packet size between 160 and 200 bytes, which is characteristic of some RTP audio streams. A threshold of 100 such packets from the same source within 10 seconds triggers the alert, indicating a sustained audio stream.
This rule detects the upload of a PNG image file over HTTP using a POST request. This could indicate an attacker exfiltrating screen captures, which aligns with MITRE ATT&CK technique T1113 (Screen Capture). The rule specifically looks for the HTTP POST method and the PNG file signature (89 50 4E 47) within the file data.
This rule detects a UDP flood Denial of Service (DoS) attack targeting the home network. It triggers an alert if more than 1000 UDP packets are observed from any source to any destination within the home network within a 5-second interval, tracked per destination.
This rule detects a TCP SYN Flood Denial of Service (DoS) attack. It triggers when a high volume of TCP SYN packets (1000 packets within 5 seconds) are observed targeting a single destination IP address within the HOME_NET, indicating an attempt to overwhelm the target's network resources.
This rule detects the exfiltration of encrypted archives over HTTP POST requests. It specifically looks for HTTP POST methods, the presence of file data, the 'PK' magic bytes indicating a ZIP or similar archive, and a file size greater than 50,000 bytes. This combination suggests an attempt to send a large, potentially encrypted, archive out of the network.
This rule detects network connections to TCP port 45700, which is a default port used by the XMRig cryptocurrency miner. The detection specifically looks for the initiation of a connection (SYN flag) from the internal network ($HOME_NET) to any external host. This activity is indicative of a system within the internal network potentially running an XMRig miner, which aligns with the MITRE ATT&CK technique T1496 (Resource Hijacking).
Page 211 of 211