Ali AlEnezi
@siteCompletionist
2 followers45 downloads259 copies6 likes5,242 views
78 detections
Filters
Last updated
All Time
Detection languages
33
30
7
5
2
Categories
31
29
22
11
11
Platforms
40
16
15
14
10
Products / Services
31
30
16
8
6
MITRE Techniques
16
11
9
9
7
CVEs
3
2
2
2
1
IDS Classtypes
10
8
5
4
3
IDS Protocols
23
5
4
1
Detects emails where the subject line contains a 13-16 digit number, potentially indicating sensitive numerical patterns like a Credit Card. The rule looks for contiguous digits or common dashed/spaced credit card formats and filters out common automated email keywords to reduce false positives.
This rule detects suspicious process command-line activity on devices identified as ATMs. It looks for known malware-related executables (CSCSERVICE.EXE) and common ATM software components (DISPENSR, XFS, MSXFS, AGILIS, APTRA, PROCASH, *.xfs) being executed or initiated by unusual processes like svchost.exe, rundll32.exe, or regsvr32.exe. This activity could indicate an attempt at ATM jackpotting or other unauthorized access.
Detects cleartext network connections using FTP (port 21) or Telnet (port 23) to external IP addresses. This rule specifically filters out internal RFC1918 traffic to focus on public-facing cleartext communications, addressing compliance requirements such as PCI-DSS for strong cryptography over public networks.
Detects emails where the subject line contains a 13-16 digit number, potentially indicating sensitive numerical patterns like a Credit Card. The rule looks for contiguous digits or common dashed/spaced credit card formats and filters out common automated email keywords to reduce false positives.
This rule detects emails that contain keywords related to 'civil id' in English or Arabic and subsequently extract potential Civil ID numbers from the email body. It then validates the extracted numbers based on birth month and day, and categorizes the risk level based on sender's domain and attachment count. This could indicate data exfiltration or sensitive information exposure.
This rule detects potential exposure of Payment Card Industry (PCI) data, specifically Payment Account Numbers (PANs), within network traffic. It looks for keywords related to payment information (e.g., 'post', 'put', 'payment', 'card', 'ccnum', 'account number') in conjunction with sequences of 13 to 19 digits that resemble PANs. The rule attempts to filter out masked PANs (e.g., those containing '****' or 'xxxx'). This could indicate sensitive data being transmitted insecurely or logged inappropriately.
This rule detects multiple failed authentication attempts for a single user from a specific source IP and host. This behavior can indicate a brute-force attack or password guessing attempt against user accounts.
Detects DNS queries to the known command and control domain bad-example-c2.com, converted from a Suricata detection rule.
Page 8 of 8