Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,362 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Detects KernelCallbackTable manipulation for process injection via kernel callback
Detects reflective DLL loading technique that avoids writing files to disk
Detects launchctl used to load services for macOS persistence or execution
Detects commands used to disable or impair security defenses
Detects C2 commands triggering disk wipe operations for destructive impact
Detects HTTP application-layer flood attacks for denial of service impact
Detects users clicking malicious links that result in malware payload downloads
This rule detects attempts to create new accounts on major cloud platforms (AWS, Azure, Google Cloud) by monitoring HTTP traffic for specific hostnames and the 'signup' keyword in the URI. It specifically looks for connections to 'aws.amazon.com', 'portal.azure.com', or 'console.cloud.google' with 'signup' in the URI, indicating a potential account creation activity.
This rule detects the use of a suspicious wildcard certificate in the TLS handshake where the certificate subject contains a wildcard character followed by a domain name with a specific pattern (6 to 12 alphanumeric characters) and a top-level domain (TLD) from a list associated with malicious activities (xyz, top, club, icu). This pattern is often observed in attack infrastructure, particularly for phishing or command and control (C2) servers, to make them appear more legitimate or to facilitate rapid domain generation. The rule specifically looks for '*.domain.tld' where 'domain' is 6-12 chars and 'tld' is one of the specified suspicious TLDs.
This rule detects HTTP requests made to well-known AI service API endpoints (OpenAI, Anthropic, Google Generative Language) specifically targeting 'completions' functionality. It triggers an alert if a single source IP makes more than 30 such requests within a 60-second window, indicating potential automated or high-volume use of AI tools for content generation, which could be leveraged for attack content.
Page 78 of 211