Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,458 downloads7,120 copies47 likes38,563 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects incoming HTTP requests to Microsoft Exchange servers that match patterns indicative of exploitation attempts for the ProxyLogon SSRF vulnerability (CVE-2021-26855). This includes detecting specific manipulation of the Autodiscover service and the injection of X-BEResource or X-AnonResource-Backend headers, which were commonly used during the initial access phase of this campaign.
This rule detects the repeated use of known default credentials (specifically common factory passwords) across multiple device hostnames. It monitors process command lines or event log data for password patterns matching specific hardcoded strings associated with camera device vulnerabilities. By aggregating hits across different devices, it identifies potential automated brute-force or credential-stuffing campaigns targeting IoT camera infrastructure.
This rule detects the repeated use of known default credentials (specifically common factory passwords) across multiple device hostnames. It monitors process command lines or event log data for password patterns matching specific hardcoded strings associated with camera device vulnerabilities. By aggregating hits across different devices, it identifies potential automated brute-force or credential-stuffing campaigns targeting IoT camera infrastructure.
Detects network DNS queries to known SpiceRAT-associated hostnames that resolve to specific C2 IP addresses. The rule identifies suspicious network activity by aggregating resolution counts and monitoring for connections to multiple dispersed IPs, which is consistent with command-and-control behavior.
Detects anomalous DNS query patterns where a single host resolves multiple unique subdomains associated with Dahua or QuickDDNS services. This behavior is indicative of passive reconnaissance, often used to map public-facing IoT devices such as cameras and DVRs.
This rule detects the creation or modification of specific files ('auth_codes.json' or files containing 'seria2') associated with the offline recovery process of Dahua devices. The presence of these files suggests an attempt to utilize or access deterministic recovery codes to bypass authentication on the device.
Detects TLS connections where the certificate subject is 'azure.uzrailwaystax.com' and the issuer is 'TLC DV TLS CA', indicating potential impersonation of the Uzbekistan railway authority infrastructure, likely associated with SilkParasite activity.
Detects HTTP GET requests to a specific URL path containing an image file, which is associated with the delivery of the LausivLoader malware. The rule monitors for external connections to the domain 'yapw.life' requesting a PNG file, a technique often used for steganographic payload delivery.
Detects network traffic associated with SilkParasite SpiceRAT malware, including direct IP connections, DNS queries for known malicious domains, and corresponding TLS SNI or HTTP Host header metadata indicating command-and-control (C2) activity.
Detects high-frequency HTTP requests to the Dahua easy4ipcloud.com password recovery endpoint. The rule monitors for abnormal volumes of reset requests from a single IP address, which is indicative of an attacker attempting to use offline-generated recovery codes to bypass authentication on Dahua IoT devices.
Page 471 of 1168