Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,361 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Detects exfiltration of running application window list for reconnaissance
This rule detects network traffic containing the strings "CreateProcessWithTokenW" and "MAXIMUM_ALLOWED" in HTTP client data. This combination of strings is indicative of a payload attempting a privilege escalation technique, specifically leveraging the Windows API function CreateProcessWithTokenW, often used in conjunction with token manipulation to achieve higher privileges. The `flow:to_client` indicates that the payload is being sent from the server to the client, suggesting a potential download or response containing the malicious code.
This rule detects attempts to query the Windows Registry remotely for the 'HKLM\Software\RealVNC' key over TCP port 445 (SMB). This activity is indicative of an attacker attempting to locate stored credentials, specifically those related to RealVNC, which could then be used for further lateral movement or privilege escalation. The detection is based on the presence of the string 'HKLM\Software\RealVNC' in the network traffic.
This rule detects DNS queries that contain non-standard hex-encoded data, which is often indicative of Command and Control (C2) communication. Specifically, it looks for DNS queries where the query name contains a sequence of 32 or more hexadecimal characters (0-9, a-f). This pattern is frequently used by malware to exfiltrate data or receive commands via DNS tunneling, where data is encoded into subdomains.
This rule detects potential air-gap bridging activity via removable media. Specifically, it looks for SMB traffic on port 445 containing the string "USBSTOR" (case-insensitive) and the file extension ".bin" (case-insensitive). This combination suggests a file transfer related to USB storage, possibly a firmware update or a malicious payload, being moved across a network segment, potentially bypassing an air-gapped system.
This rule detects attempts to perform remote DLL injection via UNC path writes over SMB. It specifically looks for SMB traffic to port 445 on the home network, containing ".dll", "\\", and "System32" in a case-insensitive manner. This combination suggests an attempt to write a DLL file to a System32 directory on a remote machine using a UNC path, which is a common technique for DLL injection.
This rule detects potential parent PID spoofing attempts by monitoring HTTP traffic for the presence of specific Windows API calls related to process creation and attribute modification. Specifically, it looks for 'UpdateProcThreadAttribute' and 'PROC_THREAD_ATTRIBUTE_PARENT_PROCESS' in the file data of HTTP responses, indicating that a client might be receiving instructions or code to perform parent PID spoofing.
This rule detects attempts to sell or exchange VPN credentials by looking for the keywords "vpn" and "credentials" in the client body of HTTP traffic. This could indicate an attacker attempting to monetize stolen VPN access or an insider threat attempting to leak sensitive access information.
This rule detects HTTP POST requests to known paste sites (pastebin.com, paste.ee, hastebin.com) with a data size greater than 500 bytes. This behavior is often associated with adversaries using these sites to host malicious payloads or exfiltrate data.
This rule detects the delivery of a malicious PowerShell profile script named 'profile.ps1' via HTTP. The rule specifically looks for the string 'IEX' (Invoke-Expression) within the file data, indicating an attempt to execute arbitrary commands. This technique is often used for persistence, where an attacker modifies a PowerShell profile to execute malicious code every time PowerShell is launched.
Page 68 of 211