Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,362 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects a replication request to a Domain Controller (DC) containing the string "DsGetNCChanges" over TCP port 389 (LDAP). This specific string is associated with Active Directory replication. The rule is designed to identify potential rogue Domain Controllers attempting to replicate with legitimate DCs, which could indicate an attacker trying to establish a malicious DC for credential harvesting or other attacks. A threshold of 3 occurrences within 60 seconds from the same source IP is set to reduce false positives.
This rule detects emails sent to the internal network (SMTP port 25) that attempt to impersonate an internal IT department. It specifically looks for the 'From:' header, the phrase 'IT Department' (case-insensitive), and the word 'password' (case-insensitive) within the email content. This combination suggests a social engineering attempt, likely phishing, to trick recipients into revealing credentials.
This rule detects the delivery of a Microsoft Installer (MSI) package via HTTP that exhibits characteristics of a malicious file. It specifically looks for HTTP responses (flow:to_client) containing a URI with the ".msi" extension (http.uri; content:".msi"; nocase;) and the magic bytes "D0 CF 11 E0" (content:"|D0 CF 11 E0|"; depth:4;) which are indicative of an OLE2 compound document file format, commonly used by MSI files. The rule classifies this activity as 'trojan-activity'.
This rule detects the presence of anti-debugging techniques within HTTP payload data. Specifically, it looks for the strings "IsDebuggerPresent" and "ExitProcess" (case-insensitive) in the HTTP response body. The combination of these strings suggests that a malicious payload might be checking for a debugger and attempting to terminate if one is detected, a common defense evasion technique used by malware.
This rule detects attempts to access the Security Account Manager (SAM) database remotely over Server Message Block (SMB). It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, containing the string "\SAM" (case-insensitive) and "NtOpenFile" (case-insensitive). This combination suggests an attempt to open the SAM database file, which could indicate credential access attempts.
This rule detects network traffic containing the string "chmod 777" followed by "/tmp/" (case-insensitive) within a TCP flow to a server on port 22. This pattern suggests an attempt to change file permissions to world-writable (777) in the /tmp directory, which is a common tactic used by malware to hide or execute malicious files.
This rule detects the delivery of a fake GUI login prompt over HTTP, likely for credential capture. It looks for HTTP responses (flow:to_client) containing the strings "ShowDialog", "Password", and "GetWindowText" (case-insensitive) within the file data. This combination of keywords suggests an attempt to mimic a legitimate login interface to trick users into providing their credentials.
This rule detects attempts to access sensitive credential-related files (e.g., configuration files, credential files, .env files, or files containing 'secret') via HTTP requests. This pattern is often associated with web shell activity where an attacker tries to exfiltrate sensitive information from a compromised web server.
This rule detects potential MFA bypass attempts using Evilginx by looking for HTTP POST requests to the server that contain both 'session' and 'token' in the URI, with a body size greater than 100 bytes. This pattern is indicative of session token capture, a technique used by Evilginx to bypass multi-factor authentication.
This rule detects attempts at token impersonation by looking for the strings "ImpersonateLoggedOnUser" and "DuplicateTokenEx" within HTTP response bodies. This technique is often used by attackers to elevate privileges by impersonating a logged-on user's security token.
Page 87 of 211