Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,358 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Detects SID history manipulation for domain privilege escalation
Detects DNS lookups to Pastebin used for dead drop C2 configuration retrieval
Detects creation of dot-prefixed hidden files used to hide malware on Linux/macOS
Detects delivery of process injection toolkit payloads via network
Detects modification of PAM configuration files allowing authentication bypass
Detects large data transfers to removable storage media for physical exfiltration
Detects delivery of malicious dylib files for macOS library hijacking
Detects download of potentially malicious browser extension CRX packages
Detects VNC connections used for visual remote desktop lateral movement
This rule detects attempts to disable AWS CloudTrail logging via the AWS API. It specifically looks for HTTP requests to 'cloudtrail.amazonaws.com' with 'StopLogging' in the URI, indicating an attempt to stop CloudTrail from recording API activity.
Page 46 of 211