Darshan Thummar
@MightyCompletionist
1 follower12 downloads680 copies5 likes8,362 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Detects installation of potentially malicious VS Code or IDE extensions
Detects MMC used with MSC files for malicious proxy execution
Detects VBA stomped Office documents where source code is stripped to evade analysis
Detects loading of shared DLL modules from suspicious network paths
This rule detects HTTP access to domains or hosts associated with bulletproof hosting infrastructure. It specifically looks for hostnames containing '.ru/', '.cn/', 'frantech', 'serverius', or 'combahton'. A threshold of 5 occurrences within 60 seconds from the same source IP triggers the alert.
This rule detects HTTP POST requests with a client body that appears to be RC4 symmetric encrypted C2 beacon traffic. It specifically looks for HTTP traffic flowing to the server, with a client body between 100 and 500 bytes in size, and whose content matches a PCRE regex for base64 encoded strings. The rule is thresholded to trigger if 20 such events occur from the same source IP within 60 seconds, indicating potential beaconing activity.
This rule detects non-DNS traffic attempting to use port 53, which is typically reserved for DNS queries. This behavior is often indicative of command and control (C2) evasion techniques, where attackers tunnel their C2 communications over a commonly allowed port to bypass firewalls and network monitoring. The rule specifically looks for TCP traffic to port 53 that is not identified as DNS application-layer protocol, originating from the home network, and establishes a flow. A threshold of 5 such events within 30 seconds from the same source IP triggers the alert.
This rule detects potential data exfiltration of removable media file contents over HTTP. It specifically looks for HTTP POST requests to a URI containing "upload" with a payload size greater than 50,000 bytes. A threshold is applied to prevent excessive alerts, triggering if 5 such events occur from the same source within 60 seconds.
This rule detects the use of SSH multiplexing, specifically the 'ControlMaster' feature, which can be leveraged for session hijacking. It triggers when the string 'ControlMaster' is observed in TCP traffic on port 22 (SSH) within the home network, indicating an attempt to establish or utilize an SSH multiplexing control channel. A threshold of 3 occurrences within 30 seconds from the same source IP is set to reduce false positives.
This rule detects potential SSH session hijacking attempts that leverage agent forwarding abuse. It specifically looks for a byte sequence within the SSH traffic that could indicate such an attack. The rule targets TCP traffic on port 22 (SSH) flowing from the client to the server, ensuring the connection is established.
Page 99 of 211