Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,359 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Detects cron job creation for Linux persistence or execution
Detects removal of Zone.Identifier ADS to bypass MOTW security prompts
This rule detects the delivery of a payload via HTTP that contains junk code padding and appears to be an executable file. Specifically, it looks for the byte sequence '90 90 90 90 90 90 90 90 90 90' (often used as NOPs for padding or obfuscation) followed by the 'MZ' magic bytes at the beginning of a file (indicating a Windows executable). The detection is triggered on HTTP responses flowing to the client.
Detects bulk registry queries over SMB for system discovery
This rule detects the delivery of a polymorphic engine payload via HTTP. It looks for specific content within the HTTP response body, including the strings "mutate" and "engine" (case-insensitive), and the "MZ" magic bytes at the beginning of the file data, indicating a Windows executable. This combination suggests the download of a polymorphic malware component designed to evade detection.
Detects access to browser profile data outside of authorized browser processes
Detects deletion of MFA configurations to enable authentication bypass
Detects registration of malicious port monitor DLLs via print spooler
Detects addition of AV exclusion paths to hide malicious files from scanning
This rule detects attempts to clear network connection history by deleting the wtmp log file via an SSH connection. The rule specifically looks for the command 'rm -rf /var/log/wtmp' being sent over TCP port 22 (SSH). This activity is often associated with defense evasion tactics used by attackers to remove forensic evidence.
Page 57 of 211