Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,358 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Detects systemd timer unit file creation for Linux scheduled task persistence
Detects attempts to bypass macOS Gatekeeper security controls
Detects Kubernetes CronJob creation for scheduled malicious execution
Detects replacement of service binaries for execution flow hijacking
Detects Kerberoasting via service ticket enumeration tools
Detects removal of network share connections to hide unauthorized access
Detects enumeration of S3 bucket objects for cloud data discovery
This rule detects the use of TLS protocol on port 443 with a specific content signature, indicating potential Command and Control (C2) activity. It triggers an alert if 20 such connections are observed from the same source within 60 seconds.
This rule detects attempts to overwrite the Master Boot Record (MBR) or disk structure using the 'dd' command via a remote SSH connection. Specifically, it looks for the string 'dd if=/dev/zero of=/dev/sda' within TCP traffic on port 22 (SSH). This command, if executed, would wipe the primary disk, leading to system destruction.
Detects audio capture and exfiltration via RTP media streams
Page 39 of 211