Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,357 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Detects abuse of Active Directory Certificate Services for credential forgery
Detects network service scanning for target discovery
This rule detects DNS queries to known dynamic DNS providers, which can be indicative of Command and Control (C2) infrastructure. Adversaries often use dynamic DNS services to maintain persistent access to compromised systems, as the IP addresses of their C2 servers may change frequently. The rule specifically looks for queries containing domains like duckdns.org, no-ip.com, ddns.net, hopto.org, zapto.org, and sytes.net.
Detects registration of malicious authentication packages for credential capture
Detects Telnet access to network devices for infrastructure compromise
Detects process hollowing technique for code injection
Detects C2 traffic using non-standard ports to evade detection
Detects automated bulk account registration for establishing fake identities
Detects use of custom encoding methods to archive data for exfiltration
Detects pulling of potentially malicious container images from registries
Page 27 of 211