Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,357 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Detects access to Chrome Login Data SQLite file for credential theft
Detects TeamViewer being used for unauthorized persistent remote access
Detects high-volume POST requests to login forms indicating credential harvesting
Detects bulk download of AWS S3 objects indicating cloud data theft
Detects cmd.exe spawned from web server process
Detects DNS-based data exfiltration via high-volume TXT record queries
Detects Cobalt Strike based on default TLS certificate patterns
Detects upload of malicious payloads to file hosting services for staging
Detects bulk cloning of GitHub repositories for source code collection
This rule detects a multi-stage command and control (C2) domain rotation pattern by identifying DNS queries for domains that match a specific regular expression. The pattern looks for domains consisting of 6 to 12 lowercase alphanumeric characters followed by one of several top-level domains (xyz, top, icu, club, online). A threshold of 5 such queries from the same source within 60 seconds is used to trigger the alert, indicating potential malicious activity like fast flux or domain generation algorithms (DGAs) used by malware for C2 communication.
Page 36 of 211