Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,358 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Detects fingerprinting of web application CMS versions for vulnerability research
Detects addition of malicious login items on macOS for user-context persistence
Detects delivery of malicious Outlook form scripts for persistence
Detects phishing links with credential harvesting redirects
Detects exploitation of Kerberos protocol for credential theft
Detects attempts to dump SAM database for local credential extraction
This rule detects Bluetooth Object Exchange (OBEX) Protocol data transfer activity on TCP port 3232. The rule is configured to alert when five such data transfers are observed from the same source IP within a 60-second window, indicating potential exfiltration or unauthorized data movement over Bluetooth.
This rule detects NBT-NS (NetBIOS Name Service) poisoning responses. NBT-NS poisoning is a technique used by attackers to intercept network traffic by responding to NetBIOS name queries with their own IP address, effectively redirecting traffic. The rule specifically looks for UDP traffic on port 137 (NetBIOS Name Service) destined for the home network, containing the byte sequence '|85 00|' at a depth of 4 bytes, which is indicative of a NetBIOS Name Service response. A threshold of 5 such responses within 10 seconds from the same source IP triggers the alert, aiming to reduce false positives from legitimate, but infrequent, NBT-NS responses.
Detects hidden iframes used for drive-by download attacks
Detects enabling of reversible password encryption in Active Directory
Page 44 of 211