Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,361 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects potential phishing attempts involving malicious file sharing via OneDrive. It specifically looks for HTTP traffic directed to 'onedrive.live.com' with 'sharing' in the URI. A threshold is set to trigger an alert if five such events occur from the same source within 60 seconds, indicating a potential automated or repeated attempt to share malicious content.
This rule detects a pattern indicative of a rogue network device performing keyboard injection. It specifically looks for the case-insensitive string "HID" (Human Interface Device) within TCP traffic flowing from a client to a server, with a threshold of 3 occurrences within 5 seconds from the same source. This behavior is often associated with devices like USB Rubber Ducky or similar tools used for automated keystroke injection.
This rule detects large encrypted data uploads (over 65KB) on TCP port 8443, which is an alternate port often used for TLS/HTTPS traffic. The rule triggers if 10 such uploads occur from the same source within 60 seconds, indicating a potential policy violation or data exfiltration attempt.
This rule detects potential data exfiltration over TLS to non-standard endpoints. It triggers when a large amount of data (greater than 65000 bytes) is sent from the home network to any destination IP on port 443 (HTTPS). A threshold is applied, triggering an alert if this occurs 20 times within 60 seconds from the same source IP, indicating a high volume of outbound encrypted traffic.
This rule detects attempts to push malicious firmware to a device via TFTP (Trivial File Transfer Protocol). It specifically looks for UDP traffic on port 69 (TFTP) where the packet content starts with "|00 02|" (indicating a TFTP write request) and the data size is greater than 10000 bytes, suggesting a firmware image transfer.
This rule detects attempts to upload web shells for website defacement. It specifically looks for HTTP POST requests where the URI contains the string "deface" (case-insensitive). This combination suggests an attacker is trying to modify a website's content, potentially by uploading a malicious script or file.
This rule detects the creation of an Azure Blob Lifecycle Management rule that is configured for deletion. It specifically looks for HTTP PUT requests to blob.core.windows.net with 'managementPolicies' in the URI, indicating an attempt to define or modify lifecycle policies for Azure Blob Storage, potentially for data deletion.
This rule detects potential data exfiltration attempts via Slack incoming webhooks. It triggers when an HTTP POST request is made to 'hooks.slack.com' with a URI containing '/services/' and a data size greater than 500 bytes. This pattern is indicative of an application or script sending data to a Slack channel using a webhook.
Direct TCP SYN Flood DoS Attack
Suricata
This rule detects a direct TCP SYN flood Denial of Service (DoS) attack. It triggers when a destination IP address receives 1000 or more TCP SYN packets within a 5-second window. The 'flags:S' indicates that only packets with the SYN flag set are counted. This type of attack aims to exhaust the target's resources by initiating many half-open connections.
This rule detects attempts to overwrite the Master Boot Record (MBR) or disk structure using the 'dd' command via a remote SSH connection. Specifically, it looks for the string 'dd if=/dev/zero of=/dev/sda' within TCP traffic on port 22 (SSH). This command, if executed, would wipe the primary disk, leading to system destruction.
Page 70 of 211