Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,359 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Detects data exfiltration occurring over non-standard alternate network mediums
Detects malicious LNK files using icon smuggling to hide their true nature
Detects injection of malicious URLs into Outlook folder home page property for persistence
Detects TCP SYN flood denial of service attacks targeting internal hosts
Detects creation of setuid binaries used for Linux privilege escalation
Detects creation of new domain accounts via LDAP for persistent access
Detects AWS Systems Manager Run Command used for remote code execution on EC2 instances
Detects SMB NTLM relay attacks used for credential capture and lateral movement
Detects system language and locale queries used to validate attack targets
This rule detects potential thread hijacking attempts by looking for the presence of specific Windows API calls, 'SuspendThread' and 'SetThreadContext', within HTTP client-to-server traffic. These API calls are commonly used in thread hijacking techniques to manipulate the execution flow of a legitimate process, often to inject and execute malicious code. The rule specifically looks for these strings within file data transmitted over HTTP, suggesting an attempt to deliver a payload that utilizes these functions.
Page 52 of 211