Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,362 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects suspicious inter-process communication (IPC) activity involving named pipes. Specifically, it looks for network traffic within the home network ($HOME_NET to $HOME_NET) that contains the string "\\.\pipe\\" (case-insensitive) and has a data payload size greater than 1000 bytes. This pattern is often associated with malware or advanced persistent threats (APTs) using named pipes for communication, especially when large amounts of data are transferred, indicating potential data exfiltration or command and control (C2) activity.
Detects installation of malicious Exchange transport agents for email persistence
Detects use of net time command for system time discovery
Detects deployment of malicious network logon scripts via domain SYSVOL
Detects malicious Docker image builds on compromised hosts for persistence
Detects fast flux DNS used to rapidly rotate C2 infrastructure IPs
Detects DLL injection using LoadLibraryA/W API calls
Detects loading of kernel modules for deep system persistence
Detects SSH agent forwarding being abused for lateral movement
Detects registration of malicious SSP DLLs for credential interception
Page 94 of 211