Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,362 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Detects download of software updates containing embedded malicious payloads
Detects Spring4Shell remote code execution exploitation attempts
Detects VNC remote service access from external IP addresses
Detects queries to certificate transparency logs for subdomain discovery
This rule detects HTTP traffic that appears to be a fake IT helpdesk page attempting to host a remote tool. It looks for the keywords "helpdesk", "download", and "remote" (case-insensitive) within the file data of HTTP responses. This combination of keywords suggests a social engineering attempt to trick users into downloading and executing remote access software under the guise of IT support.
This rule detects HTTP POST requests where the URI contains both 'wp-content' and 'uploads', indicating potential command and control (C2) communication from a compromised website, likely a WordPress site. The rule specifically looks for requests with a body size greater than 500 bytes, suggesting data exfiltration or command execution.
This rule detects HTTP requests to domains associated with free SSL certificate issuance (Let's Encrypt or ZeroSSL) where the URI contains 'acme'. This could indicate an attacker attempting to obtain a free SSL certificate for a domain they control, potentially for use in phishing or other malicious activities. The rule uses a threshold to prevent excessive alerts from legitimate certificate renewals.
This rule detects the download of common offensive security tools such as Mimikatz, LaZagne, Rubeus, BloodHound, and SharpHound. It specifically looks for these tool names within the HTTP URI during client-to-server HTTP traffic.
This rule detects a high rate of HTTP GET requests that are likely resulting in 404 (Not Found) errors, indicative of a directory brute-force attack. The rule triggers if a single source IP makes 50 or more HTTP GET requests within a 10-second window, suggesting an automated attempt to discover hidden directories or files on a web server.
This rule detects HTTP requests where the User-Agent header contains the string "ffuf" (case-insensitive). FFUF (Ffuf is a Fast Web Fuzzer) is a common tool used for web enumeration, including directory and file brute-forcing. Detection of this User-Agent indicates a potential reconnaissance activity or an attempt to discover hidden web resources.
Page 95 of 211