Ali AlEnezi
@siteCompletionist
2 followers45 downloads259 copies6 likes5,242 views
78 detections
Filters
Last updated
All Time
Detection languages
33
30
7
5
2
Categories
31
29
22
11
11
Platforms
40
16
15
14
10
Products / Services
31
30
16
8
6
MITRE Techniques
16
11
9
9
7
CVEs
3
2
2
2
1
IDS Classtypes
10
8
5
4
3
IDS Protocols
23
5
4
1
This rule detects the creation, modification, or renaming of directories related to the malicious 'plain-crypto-js' npm package within a 'node_modules' folder. This activity is indicative of a supply chain compromise where a legitimate package (Axios) was found to include this malicious dependency.
Detects unusual outbound network connections from ATM devices (identified by device names containing 'ATM', 'NCR', 'DIEBOLD', 'WINCOR'). The rule flags connections to public IP addresses, excluding common internal networks and standard web/DNS ports (80, 443, 53). Alerts are triggered if an ATM device shows a high number of connections, unique remote IPs, or significant data transfer, indicating potential compromise or unauthorized activity.
This rule detects the creation, writing, or renaming of specific files associated with the compromised Axios npm package versions 1.14.1 and 0.30.4. Upon installation, the postinstall script of these compromised packages deploys dropper scripts to download and install a remote access trojan on Mac, Linux, or Windows endpoints. The rule specifically looks for file paths indicative of these dropper activities across different operating systems.
This rule detects the exposure of Kuwaiti Civil ID numbers in various log sources, including process command lines, additional device event fields, and email subjects/sender addresses. A Kuwaiti Civil ID is identified by a 12-digit number starting with 1, 2, or 3.
This rule detects the first stage of activity once a compromised endpoint runs the affected Axios package (versions 1.14.1 and 0.30.4). It specifically looks for process creation events where the command line contains a call out to the C2 domain 'sfrclak.com'. This indicates the dropper scripts attempting to establish communication with their command and control server.
This query identifies HTTP(S) requests logged within Ivanti EPMM (formerly MobileIron) logs that match exploitation URI parameters, specifically looking for '/mifs/c/appstore/fob' and '=gPath' in the HTTP_Request_URI. The EPMM Version number is also extracted to provide additional context for security teams to identify if their software version is vulnerable.
This rule detects suspicious network communication patterns indicative of command and control (C2) activity by analyzing the jitter (variability) in connection gaps and byte transfer sizes. It identifies connections with a high number of events, a consistent average gap between connections, and low jitter in both connection timing and data transfer sizes (bytes out and bytes in). This pattern can suggest automated, scheduled communication often associated with C2 channels.
This rule detects suspicious activity involving multiple POST requests to Livewire update endpoints on web servers, followed by the spawning of unusual processes from web server parent processes (php, apache, httpd, nginx, php-fpm). The spawned processes of interest include various shells (sh, bash), command-line tools (curl, wget, python, perl, nc), or commands containing base64 encoding, chmod +x, or /tmp/ paths. This behavior could indicate a web shell compromise or successful exploitation leading to command execution.
This rule detects DNS requests for domain names that combine Middle Eastern-themed keywords (dubai, emirates, iran, saudi, etisalat) with suspicious or cheap Top-Level Domains (TLDs) such as .top, .cyou, .click, .life, .mom, .sbs, or .xyz. This pattern can indicate potential phishing attempts, malicious infrastructure, or C2 communication attempting to blend in with legitimate traffic by using seemingly relevant but low-cost domains.
This rule detects DNS resolution requests to specific malicious command and control (C2) domains, 'sfrclak.com' and 'callnrwise.com', which have been linked to the 'Axios attack'. Detection of these domains indicates potential compromise and active C2 communication.
Page 7 of 8