Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,358 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects a multi-stage command and control (C2) domain rotation pattern by identifying DNS queries for domains that match a specific regular expression. The pattern looks for domains consisting of 6 to 12 lowercase alphanumeric characters followed by one of several top-level domains (xyz, top, icu, club, online). A threshold of 5 such queries from the same source within 60 seconds is used to trigger the alert, indicating potential malicious activity like fast flux or domain generation algorithms (DGAs) used by malware for C2 communication.
Detects suspicious AWS STS AssumeRole calls for temporary elevated access
Detects HID keystroke injection attacks from hardware implants
Detects use of strip or UPX to remove debug information from malware
Detects relocation of malware to new paths to evade detection signatures
Detects high-rate DNS queries indicating subdomain enumeration
Detects injection of malicious scripts into legitimate websites for watering hole attacks
Detects copying of Outlook PST/OST files for email collection
Detects ptrace access to securityd process memory for credential extraction
Detects stolen web session cookies being replayed from different IP addresses
Page 37 of 211