Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,362 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Detects LDAP account modifications used to maintain persistent access
Detects PowerShell command obfuscation techniques used to evade detection
Detects LD_PRELOAD environment variable set to load malicious shared libraries
Detects base64 encoded payloads in HTTP request bodies indicating obfuscation
This rule detects a TCP SYN packet (initial connection attempt) directed towards port 10443 on the home network. The message indicates this is a probe targeting a Palo Alto Firewall Management Interface. This suggests an attempt to discover or interact with a Palo Alto firewall's management interface, potentially for reconnaissance or exploitation.
This rule detects HTTP POST requests to pastebin.com's API for pasting content, specifically targeting the '/api/api_paste.php' endpoint. It triggers if the size of the data being uploaded is greater than 1000 bytes, indicating a potential data exfiltration attempt to a public text storage site.
This rule detects TCP connections originating from the internal network ($HOME_NET) to any external destination on port 9150, specifically looking for the SYN flag in the TCP handshake. Port 9150 is commonly associated with Tor Browser's SOCKS proxy. The rule's message suggests it's intended to identify instances where Tor Browser is being used to access external resources, potentially bypassing organizational policies or security controls.
This rule detects potential data exfiltration to OneDrive cloud storage. It specifically looks for HTTP PUT requests to onedrive.live.com or graph.microsoft.com with a URI containing '/content' and a data size greater than 10000 bytes. This combination suggests a large file upload to OneDrive.
This rule detects attempts to exfiltrate data to Google Drive cloud storage. It specifically looks for HTTP POST requests to 'www.googleapis.com' with the URI containing '/upload/drive/' and a data size greater than 10000 bytes. This pattern is indicative of a file upload operation to Google Drive.
This rule detects large data transfers (over 65000 bytes) to a Server Message Block (SMB) share that contains the string "USBSTOR" in its content. This combination suggests data exfiltration to removable media, as "USBSTOR" is often associated with USB storage devices. The rule uses a threshold of 20 such transfers within 60 seconds from the same source IP to trigger an alert, indicating a sustained large data transfer activity.
Page 81 of 211