Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,358 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Detects bandwidth hijacking through peer-to-peer botnet participation
Detects GRE encapsulation used to bypass network address translation controls
Detects WMI event subscriptions used for fileless persistence
Detects CMSTP used with INF files for UAC bypass and code execution
Detects execution of Electron application ASAR packages for code execution
Detects enumeration of Docker containers and images
Detects cloud resources created in rarely used geographic regions for evasion
This rule detects the delivery of a malicious XSL (Extensible Stylesheet Language) script via HTTP to a client. The detection is based on the HTTP URI containing ".xsl" (case-insensitive) and the file data containing "<msxsl:script" (case-insensitive). This pattern is indicative of an attempt to use XSLT for proxy execution, often associated with techniques like WMIC (Windows Management Instrumentation Command-line) for defense evasion.
This rule detects the use of self-signed TLS certificates where both the issuer and subject Common Name (CN) match a suspicious pattern. The pattern specifically looks for CNs that are 5 to 20 alphanumeric characters or hyphens, followed by one of several top-level domains (TLDs) commonly associated with malicious activity: .xyz, .top, .club, .icu, or .pw. This combination of self-signed certificates and suspicious TLDs is often indicative of command and control (C2) communication from malware.
This rule detects a potential network scan activity where a source IP sends multiple NTP (Network Time Protocol) queries to the internal network within a short period. Specifically, it triggers if a single source IP sends 5 or more UDP packets to destination port 123 (NTP) on the home network within a 30-second window. This behavior can indicate an attacker attempting to discover systems or services on the network by querying for system time.
Page 48 of 211