Lawton Pittenger
@lawtonpittenger3 followers152 downloads2 copies9 likes482 views
10 detections
Filters
Last updated
All Time
Detection languages
10
Categories
10
MITRE Techniques
10
6
5
3
3
This rule enables logging of JA3 and JA3S hashes in AWS Network Firewall to enhance visibility into TLS connections, useful for identifying malicious activities.
This rule identifies and blocks TLS connections using JA4 fingerprints without SNI, as they may indicate suspicious, potentially malicious encrypted traffic.
This rule is a valid AWS Network Firewall configuration enforcing standard port/protocol usage for SSH traffic to maintain network hygiene and detect anomalies.
This rule enforces standard port/protocol alignment for TLS traffic to detect anomalies and maintain network hygiene using AWS Network Firewall. The rule is valid.
This rule configures AWS Network Firewall to block outbound traffic to IPs located in high-risk countries, such as Russia and China, as a preventive security measure.
This rule enforces port/protocol alignment for HTTP traffic using AWS Network Firewall, blocking TCP port 80 traffic that is not HTTP and vice versa, to maintain network hygiene and detect anomalies. The rule is valid.
This rule monitors AWS Network Firewall for HTTP and TLS connections to domains with uncommon TLDs to identify anomalous behavior without blocking traffic, providing visibility rather than specific threat detection.
This rule blocks connections made directly to IP addresses instead of domain names, a technique often used by malware to evade detection, leveraging AWS Network Firewall and Suricata.
This rule provides a preventive configuration for AWS Network Firewall that blocks outbound HTTP and TLS connections to domains using high-risk country-code top-level domains (ccTLDs) like .ru and .cn.
This rule blocks HTTP and TLS connections to domains with high-risk TLDs like .xyz, .info, and .top due to their frequent association with malicious activities.