Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,361 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to dump router configuration via a Telnet session. Specifically, it looks for the string "show running-config" being sent to a Telnet server on the home network. This command is commonly used on network devices to display their current running configuration, and its use over an unencrypted protocol like Telnet could indicate unauthorized access or data exfiltration.
This rule detects the exfiltration of a custom XOR-compressed archive over HTTP. It specifically looks for HTTP POST requests originating from the home network, containing file data, with a payload size greater than 10000 bytes, and a PCRE match for a sequence of at least 200 non-ASCII or control characters, which is indicative of XOR-compressed binary data.
This rule detects the creation of a tar archive using the 'tar -czf' command, specifically when the archive is being created in the '/tmp/' directory over an SSH connection. This activity is indicative of data staging, where an attacker might be preparing data for exfiltration or further malicious use.
This rule detects when a user downloads a large amount of Slack message history via the Slack API. It specifically looks for HTTP requests to 'slack.com' with the URI '/conversations.history' and triggers an alert if 20 such requests are observed from the same source IP within a 60-second window. This behavior could indicate an attempt to exfiltrate sensitive communication data.
This rule detects potential network scanning activity targeting LDAP services (port 389) for user session information. It specifically looks for LDAP queries containing "(objectClass=user)" and "lastLogon" within the established TCP flow to the server. A threshold of 5 such queries from the same source within 30 seconds triggers the alert, indicating a possible attempt to enumerate active user sessions.
This rule detects attempts to enumerate domain trusts by querying LDAP for objects with the 'objectClass=trustedDomain' attribute. This activity is often performed by attackers during the discovery phase to map out the network topology and identify potential lateral movement paths. The rule specifically looks for TCP traffic to port 389 (LDAP) on the home network, containing the specified LDAP filter, and uses a threshold to prevent excessive alerts from legitimate, but frequent, queries.
This rule detects the exfiltration of browser bookmarks over HTTP POST requests. It specifically looks for HTTP POST requests where the client body contains the string "Bookmarks" (case-insensitive) and the data size is greater than 500 bytes. This pattern is indicative of an attacker or malware attempting to steal a user's browser bookmarks.
This rule detects HTTP requests to the Kubernetes API endpoint '/api/v1/pods' on port 8080. This activity is indicative of an attempt to discover Kubernetes pods and services, which could be part of reconnaissance by an attacker or an authorized user.
This rule detects potential sandbox evasion techniques by identifying HTTP traffic (specifically client-to-server responses) that contains both 'GetCursorPos' and 'Sleep' within the file data. This combination is often used by malware to check for user interaction (mouse movement) and introduce delays, which can indicate an attempt to determine if it's running in a sandboxed environment.
This rule detects network traffic (specifically HTTP responses) that contains patterns indicative of malware attempting to prevent double execution using mutexes. It looks for the strings "CreateMutex" and "ALREADY_EXISTS" (case-insensitive) within the file data of the HTTP response. This behavior is common in malware to ensure only one instance of itself is running on a system, often as a defense evasion technique.
Page 72 of 211