Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,357 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Detects fake Windows authentication prompts used to capture credentials
Detects network callbacks from hardware implants like O.MG Cable or USB Rubber Ducky
Detects deletion of cloud security group rules to weaken network security
Detects enumeration of Wi-Fi networks and saved profiles
Detects process argument spoofing to hide true command line from defenders
Detects high-volume use of AI APIs potentially for generating attack content
Detects unauthenticated access to Docker daemon API for container escape
This rule detects potential domain fronting activity used to hide Command and Control (C2) servers. It specifically looks for HTTP traffic where the TLS Server Name Indication (SNI) or HTTP Host header contains known domain fronting providers like cloudfront.net or azureedge.net, combined with a suspicious pattern in the HTTP Host header that includes an 8 or more character alphanumeric string followed by a top-level domain commonly associated with malicious activity (xyz, top, club, icu). This combination suggests an attempt to disguise C2 communications by routing them through legitimate content delivery networks.
Detects bulk file deletion indicating a data destruction attack
Detects installation of rootkit kernel modules for deep system hiding
Page 33 of 211