Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,359 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects HTTP requests originating from Microsoft Office Word that are attempting to fetch remote templates with specific file extensions (.dotx, .dotm, .dot). This behavior can be indicative of malicious documents attempting to retrieve external content, often used in phishing or malware delivery campaigns to bypass security controls or fetch additional stages of an attack.
This rule detects the delivery of an Electron application ASAR (Atom Shell Archive) package over HTTP. The detection is based on the presence of '.asar' in the HTTP URI, indicating a potential malicious Electron application being downloaded to a client within the home network. Electron applications are often used for desktop applications and can be exploited if malicious code is embedded within their ASAR packages.
This rule detects attempts to read the 'cpassword' field from Group Policy Preferences XML files over SMB. The 'cpassword' field was historically used to store encrypted passwords, which could be easily decrypted, leading to credential exposure. Detection of this string in SMB traffic indicates an attempt to access or exfiltrate these sensitive credentials.
This rule detects potential account takeover attempts by identifying the replay of stolen session cookies. It specifically looks for HTTP traffic from the home network to any destination, where the HTTP cookie header contains the case-insensitive string "session". A threshold of 5 occurrences within 3 seconds, tracked by destination, is used to trigger an alert, indicating a rapid succession of session cookie replays.
Detects NOP sled patterns in payloads indicating junk code insertion for evasion
Detects malicious logon scripts deployed to the NETLOGON share for domain-wide execution
Detects non-standard encoding schemes used to obfuscate C2 traffic
Detects unauthorized access to webcam for video surveillance collection
Detects Mavinject used for DLL injection into running processes
Detects scraping of job listings to identify employee roles and technology stack
Page 61 of 211