Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,357 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Detects modification of local or domain group memberships for privilege persistence
Detects exfiltration of sensitive data pushed to GitHub repositories
Detects local account RDP logins originating from external IP addresses
Detects large data transfers occurring outside normal business hours
Detects malicious script injection into HTTP responses via MitM
This rule detects a high volume of HTTP requests to Salesforce API endpoints associated with bulk data queries. Specifically, it looks for 20 or more requests within a 60-second window from a single source IP to 'salesforce.com' with URI paths containing both '/services/data/' and '/query/'. This pattern suggests a potential bulk download of customer records or other data via the Salesforce API.
Detects brute force or credential stuffing against social media accounts
Detects SQL injection patterns in HTTP requests
Detects creation of disposable email accounts used for attack infrastructure
Detects Cobalt Strike beacon default HTTP checkin pattern
Page 30 of 211