Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,348 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Detects attackers querying audit logs to understand defender visibility
Detects sensitive data exfiltration via git push to remote code repositories
Detects download of remote access tools used in vishing attacks
Detects deletion of persistence registry keys after successful execution
This rule detects the use of TLS protocol on port 443 with a specific content signature, indicating potential Command and Control (C2) activity. It triggers an alert if 20 such connections are observed from the same source within 60 seconds.
Detects APC injection technique using QueueUserAPC for code execution
Detects PsExec used for remote command execution in lateral movement
Detects LSASS process memory access for credential dumping
Detects C2 traffic obfuscated within HTTP request bodies
Detects HTTP flood application layer DDoS attacks
Page 5 of 211