Ankit Mehta
@SecvynIndiaTrusted contributorCompletionist
7 followers9,573 downloads10,251 copies160 likes55,618 views
8,655 detections
Filters
Last updated
All Time
Detection languages
5,827
1,081
677
439
436
Categories
2,646
2,040
1,304
944
814
Platforms
5,999
954
874
706
593
Products / Services
2,800
1,372
1,362
725
707
MITRE Techniques
2,087
2,043
1,442
1,092
1,085
CVEs
17
16
15
11
11
IDS Classtypes
250
132
95
68
64
IDS Protocols
405
140
49
36
14
Detects unusually fast response times for FTP LIST commands, which could indicate an automated or programmatic interaction with an FTP server, potentially related to a vulnerability exploitation or data exfiltration attempt. The rule specifically looks for network events on port 21 (FTP) where the URL contains 'LIST' and the response time is less than 100 milliseconds.
This rule detects network events originating from 'squid.exe' that involve DNS query responses or network signature inspections, specifically looking for reverse DNS lookups to an IPv4 address. This could indicate attempts to resolve IP addresses back to hostnames, potentially for reconnaissance or C2 communication.
Detects potential exploitation attempts related to the Squidbleed vulnerability by monitoring 'squid.exe' process command lines for indicators of ASAN (AddressSanitizer) heap overflow reports. This includes keywords like '==', 'ERROR', 'ERROR SUMMARY', and 'SUMMARY', which are often present in ASAN crash reports.
Detects network events where FTP (port 21) traffic contains specific timestamp-like patterns in the RemoteUrl, which could indicate an attempt to exploit the Squidbleed vulnerability related to timestamp-to-filename parsing anomalies. The rule looks for 'LIST' command combined with '12:34:56', '2026-', or 'timestamp' in the URL.
Detects FTP data connections initiated by 'squid.exe' on high port ranges (1024-65535). This could indicate an attempt to exfiltrate data using an alternative protocol, potentially related to the 'Squidbleed' vulnerability or other malicious activity.
Detects potential memory leak debugging or exploitation attempts related to the Squid proxy server by monitoring process command lines for keywords like 'leak', 'memory', 'valgrind', 'gdb', or 'debug'. This could indicate an adversary attempting to exploit a memory leak vulnerability or a developer debugging one.
Detects attempts to exploit the Squidbleed vulnerability by monitoring process command lines for Squid (squid.exe) using specific accept_filter or defer_accept related keywords. This could indicate an attempt to bypass configuration or exploit a vulnerability related to TCP connection handling.
This rule detects suspicious command-line arguments indicative of a potential buffer overflow attempt targeting the 'squid.exe' process. The presence of keywords like 'buffer+', 'ptr++', 'offset', 'increment', or 'boundary' in the command line of 'squid.exe' suggests an attempt to manipulate memory or exploit a vulnerability.
This rule monitors for a sequential attack chain occurring within a 15-minute window. It links a high-risk or risky user sign-in to subsequent reconnaissance (whoami, ipconfig), credential access (LSASS dumping, registry hive export), and lateral movement (network connections over port 445).
This rule monitors for a sequential attack chain occurring within a 15-minute window. It links a high-risk or risky user sign-in to subsequent reconnaissance (whoami, ipconfig), credential access (LSASS dumping, registry hive export), and lateral movement (network connections over port 445).
Page 711 of 866