Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,362 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects when an executable file is masquerading as an image file during an HTTP download. It specifically looks for HTTP responses with a 'Content-Type: image/' header, but where the file data begins with 'MZ', which is the magic number for Windows Portable Executable (PE) files. This indicates a potential attempt to bypass security controls by disguising malicious executables as benign image files.
This rule detects email attachments that use a double extension, specifically looking for files that appear to be common document or image types (doc, pdf, jpg) but have a hidden executable extension (exe, bat, vbs). This technique is often used by attackers to trick users into opening malicious files.
This rule detects HTTP responses from a server to a client that contain the phrase "Your computer is infected" (case-insensitive). This is indicative of a fake security alert page, often used in social engineering attacks to trick users into downloading malware or providing credentials. The rule specifically looks for this content within the file data of an established HTTP flow directed to the client.
This rule detects the delivery of an executable file over HTTP where the filename in the URI contains a space character immediately before the file extension '.exe'. This technique is often used by attackers to obfuscate the true file type or to bypass basic file type checks, making the file appear as a non-executable or a different file type to a casual observer or some automated systems. The rule specifically looks for the pattern '.exe ' (dot, exe, space) in the HTTP URI, case-insensitive.
This rule detects attempts to add an exclusion path to Windows Defender via remote registry access. Specifically, it looks for TCP traffic on port 445 (SMB/CIFS) containing the strings "Exclusions\Paths" and "WindowsDefender" (case-insensitive). This activity could indicate an attacker trying to disable or bypass antivirus protection.
This rule detects a high volume of UDP traffic on port 4500 to the home network, which is commonly used for IPSec NAT Traversal. The rule is specifically looking for an 'evasion' scenario, implying that this traffic pattern might be indicative of an attempt to bypass security controls or blend in with legitimate IPSec traffic. The threshold of 10 connections from the same source within 30 seconds suggests an attempt to identify sustained or repeated activity rather than a single, isolated event.
This rule detects NAT traversal attempts using GRE (Generic Routing Encapsulation) protocol. It specifically looks for IP packets with protocol number 47 (GRE) and triggers an alert if 5 such packets are observed from the same source IP within a 30-second window. This could indicate an attempt to bypass network address translation or firewalls.
This rule detects HTTP traffic where the URI contains the string "FromBase64String" (case-insensitive). This string is often associated with PowerShell or .NET code that decodes a Base64 encoded string, which can then be executed. This technique is commonly used by attackers for defense evasion to obfuscate malicious payloads.
This rule detects attempts to downgrade network device firmware via SSH by looking for the string "boot system flash" in TCP traffic directed to port 22 (SSH). This command is commonly used on Cisco IOS devices to specify the system image to boot from, and its presence in an SSH session could indicate an attempt to revert to an older, potentially vulnerable firmware version or to a malicious image.
This rule detects attempts to patch a Cisco IOS router image remotely via SSH. It specifically looks for the string "copy tftp flash" within TCP traffic destined for port 22 (SSH) on the home network, indicating a potential attempt to modify the router's operating system image from a TFTP server.
Page 86 of 211