Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,358 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects a Link-Local Multicast Name Resolution (LLMNR) poisoning response from a rogue host. It specifically looks for UDP traffic on port 5355 (LLMNR) where the content contains the byte sequence '|80 00|' at a depth of 4 bytes. A threshold is applied to trigger an alert if 5 such responses are observed from the same source IP within 10 seconds, indicating potential malicious activity like credential harvesting.
Detects scraping of partner and vendor relationship pages for supply chain targeting
Detects DCOM being used for remote code execution
Detects bulk deletion or disabling of accounts to lock out defenders
Detects modification of SSH authorized_keys files for backdoor access
Detects download of malware samples from sharing platforms
Detects creation of accounts with names mimicking legitimate service accounts
Detects modification of file associations to hijack execution flow
Detects attempts to modify Cisco ROMMON firmware for deep persistence
Detects creation of LNK shortcut files from browser or email context
Page 47 of 211