Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,362 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects potential data exfiltration over Bluetooth Network Encapsulation Protocol (BNEP) by monitoring UDP traffic on port 3232. It triggers an alert if more than 5 such packets are observed from a single source within a 60-second window, indicating a possible attempt to transfer data out of the network via Bluetooth.
This rule detects attempts to overwrite router firmware via an SSH session. It specifically looks for the string "flash write" within TCP traffic directed to port 22 (SSH) on the home network. This activity is indicative of an attacker attempting to modify the router's operating system, potentially for persistence, backdooring, or other malicious purposes.
This rule detects potential data exfiltration attempts via Discord webhooks. It specifically looks for HTTP POST requests to discord.com/api/webhooks/ with a data size greater than 500 bytes. This could indicate an attacker sending sensitive information out of the network using Discord's API.
This rule detects a direct User Datagram Protocol (UDP) flood Denial of Service (DoS) attack. It triggers an alert if more than 1000 UDP packets are observed targeting a single destination within a 5-second window. This high volume of UDP traffic is indicative of an attempt to overwhelm a target system or network resource, making it unavailable to legitimate users.
This rule detects a high volume of inbound emails to port 25 (SMTP), indicating a potential email bombing attack. It triggers an alert if more than 100 emails are received from a single source IP address within a 60-second window.
This rule detects internal network traffic to port 3128, which is commonly used by Squid proxy servers. The rule is specifically looking for a high volume of such connections (10 connections within 60 seconds from the same source IP) within the home network, suggesting the use of a Squid proxy for internal command and control (C2) routing. The 'flow:to_server,established' indicates that the rule triggers on established connections from a client within the home network to a server within the home network on port 3128.
This rule detects the use of MQTT (Message Queuing Telemetry Transport) over TLS on port 8883, specifically identifying it as a potential encrypted Command and Control (C2) channel. It triggers an alert if there are at least 5 established TCP connections to port 8883 from a single source within a 60-second window, indicating persistent communication often associated with C2 activities.
This rule detects non-HTTPS/non-HTTP traffic attempting to tunnel over TCP port 443. It specifically looks for established TCP connections to port 443 where the application layer protocol is neither TLS nor HTTP, indicating potential covert communication or tunneling activity often associated with malware or command and control.
This rule detects DNS responses with a very low Time-To-Live (TTL) value, which is a characteristic often associated with fast flux techniques used by malware to rapidly change IP addresses. Specifically, it looks for UDP traffic on port 53 (DNS) where the DNS response contains a specific content pattern indicating a low TTL.
This rule detects Fast Flux DNS activity, specifically rapid IP rotation on a single domain. It triggers when a destination IP address associated with a DNS query changes at least 20 times within a 10-second window. This behavior is characteristic of fast fluxing, a technique used by malware to hide command and control servers behind a constantly changing set of IP addresses.
Page 82 of 211