Ali AlEnezi
@siteCompletionist
2 followers45 downloads259 copies6 likes5,242 views
78 detections
Filters
Last updated
All Time
Detection languages
33
30
7
5
2
Categories
31
29
22
11
11
Platforms
40
16
15
14
10
Products / Services
31
30
16
8
6
MITRE Techniques
16
11
9
9
7
CVEs
3
2
2
2
1
IDS Classtypes
10
8
5
4
3
IDS Protocols
23
5
4
1
Detects inbound HTTP traffic directed to internal hosts on ports other than commonly used web ports (80, 443, 8080, 8443, 8000, 8888, 3128). This behavior may indicate an attempt to bypass network security controls or the use of non-standard ports for command and control or data exfiltration.
This rule detects HTTP requests that contain duplicate 'Content-Length' headers, a technique used to perform HTTP Request Smuggling attacks. Attackers exploit discrepancies in how front-end and back-end servers interpret duplicate or conflicting request headers to smuggle requests, bypass security controls, or gain unauthorized access to back-end systems.
This rule detects TLS handshakes where the Server Name Indication (SNI) field contains an IP address literal instead of a domain name. Legitimate web services and applications typically use FQDNs for TLS SNI to support virtual hosting. Using an IP literal in the SNI field is a technique often used by malware, C2 infrastructure, and malicious scripts to establish encrypted connections while avoiding standard DNS lookups, which may be logged or monitored.
This rule monitors for Exchange administration operations where mailbox permissions ('FullAccess', 'SendAs', or 'SendOnBehalf') are granted to a user. It specifically flags instances where the account performing the action is neither the owner of the target mailbox nor the grantee, identifying suspicious, potentially unauthorized delegation patterns.
Detects anomalous activity by newly added guest users in Microsoft Teams, specifically identifying when a guest user account is added and subsequently performs multiple file-related operations (upload, download, access) or message-sending activities within a short timeframe. This behavior can be indicative of external threat actors or compromised guest accounts exfiltrating or accessing sensitive information within a Teams workspace.
This rule detects administrative changes to domain federation settings or domain authentication configurations within an Azure Active Directory (Microsoft Entra ID) environment. These modifications can be used to establish persistence or facilitate identity-based attacks, such as domain-wide impersonation, by altering how identities are authenticated.
This rule monitors incoming HTTP requests for the presence of the Base64-encoded string 'rO0AB', which is the standard header for serialized Java objects. The presence of this header in an HTTP request body is a strong indicator of a Java deserialization exploitation attempt.
This rule detects common patterns associated with Expression Language (EL) injection attacks in HTTP traffic. These patterns typically attempt to invoke Java reflection, runtime execution, or process creation through vulnerable applications utilizing templating engines or expression evaluators (e.g., OGNL, Spring Expression Language). Attackers use these to achieve remote code execution (RCE).
This rule detects HTTP requests containing an invalid or malformed 'Transfer-Encoding' header value. Such malformations are often used in HTTP Request Smuggling (HRS) attacks to cause desynchronization between a front-end load balancer/proxy and a back-end web server, potentially allowing an attacker to smuggle requests, bypass security controls, or perform cache poisoning.
Detects anomalous TCP stream reassembly where overlapping segments contain different data. This technique is often used to bypass Network Intrusion Detection Systems (IDS) by presenting different data to the target system than what the IDS inspects.
Page 5 of 8