Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,362 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects potential data exfiltration over HTTP POST requests. It specifically looks for HTTP POST requests with a client body size greater than 500 bytes and containing the case-insensitive string "ESTABLISHED". This combination suggests that network connection data might be embedded and sent out via HTTP POST, which is a common technique for command and control or data exfiltration.
This rule detects potential ICMP tunnel command and control (C2) activity by identifying ICMP echo requests (type 8) with an unusually large data payload (greater than 100 bytes). It uses a threshold to alert if more than 20 such packets are observed from the same source IP within a 60-second window, indicating sustained communication that might be indicative of data exfiltration or C2.
This rule detects attempts to copy Firefox profile data, specifically the 'places.sqlite' file, over SMB (Server Message Block) to a server. This activity is indicative of browser reconnaissance, where an attacker might be exfiltrating browsing history and bookmarks stored in the Firefox profile for further analysis or to gain intelligence about the victim.
This rule detects attempts to query Docker version and virtual machine information via the Docker API. It specifically looks for HTTP requests to port 2375 (commonly used for Docker API) with a URI containing "/version". This activity could indicate reconnaissance by an attacker trying to gather information about the Docker environment.
This rule detects attempts to remotely enumerate Windows Event Logs over SMB. It specifically looks for TCP traffic on port 445 (SMB) where the content includes both "eventlog" and "EvtQuery" (case-insensitive), indicating a query for event log information.
This rule detects attempts to enumerate Azure Blob Storage containers. It specifically looks for HTTP requests targeting Azure Blob storage hosts (ending with '.blob.core.windows.net') and containing the query parameter '?comp=list', which is used to list containers within a storage account. This activity is indicative of reconnaissance or discovery against Azure cloud resources.
This rule detects internal HTTP file transfers using the PUT method, specifically looking for executable files (identified by the 'MZ' header) being transferred. This behavior is indicative of a possible tool drop within a network, aligning with the MITRE ATT&CK technique T1570 (Lateral Movement - Internal HTTP File Transfer). The rule focuses on traffic within the home network, suggesting an internal adversary or compromised host attempting to move malicious tools.
This rule detects potential internal SSH lateral movement attempts. It triggers an alert when there are 5 or more TCP SYN packets (indicating connection attempts) to port 22 (SSH) within a 60-second window, originating from a host within the home network and targeting another host within the home network. This threshold-based detection aims to identify rapid, repeated SSH connection attempts that could signify an attacker trying to move between internal systems.
This rule detects DNS queries that match a specific pattern indicative of C2 fallback domain rotation. The pattern looks for domains consisting of 8 to 12 alphanumeric characters followed by a top-level domain (TLD) from a list including .top, .xyz, .club, .icu, or .pw. This behavior is often associated with malware using domain generation algorithms (DGAs) or similar techniques for command and control communication, specifically as a fallback mechanism when primary C2 channels are disrupted.
This rule detects potential sandbox evasion techniques by identifying HTTP traffic containing specific API calls often used by malware to determine if it's running in a sandboxed environment. Specifically, it looks for the 'GetForegroundWindow' function, which retrieves a handle to the foreground window, and the 'Sleep' function, which can be used to delay execution and bypass time-based sandbox analysis. The combination of these two indicates an attempt to check for user interaction and evade detection.
Page 84 of 211