Tim Peck
@timpeckTrusted contributorCompletionist
31 followers5,368 downloads4,016 copies482 likes316,267 views
916 detections
Filters
Last updated
All Time
Detection languages
328
311
163
59
21
Categories
261
233
216
212
173
Platforms
416
384
95
54
21
Products / Services
332
252
142
46
33
MITRE Techniques
297
271
243
190
183
CVEs
6
5
4
3
3
IDS Classtypes
86
72
36
34
25
IDS Protocols
183
53
48
14
2
This rule detects HTTP requests to archive.org for image files (png, jpg, jpeg, svg, gif, tiff) that have minimal request headers, specifically lacking both 'User-Agent' and 'Referer' headers. This behavior can be indicative of automated tools or malware attempting to retrieve content while trying to evade detection or hide their origin.
This rule detects attempts to exploit CVE-2021-20021, an unauthenticated arbitrary user creation vulnerability in SonicWall Email Security. The detection is based on HTTP GET requests to the '/createou' URI containing 'data=' in the request body, which is indicative of an exploitation attempt.
This rule detects inbound network traffic attempting to exploit an open redirect vulnerability within the Google APIs 'AddItNow' service. Specifically, it looks for requests to 'apis.google.com/additnow/l?__lu=' which could be used to redirect users to arbitrary malicious websites.
This rule detects attempts to exploit the Zip Slip vulnerability by identifying ZIP archive uploads containing directory traversal sequences ('../') within filenames. This technique allows attackers to write files outside the intended extraction directory, potentially leading to arbitrary file overwrite or remote code execution.
ET INFO Blockchain RPC Domain in DNS Lookup (api .avax .network)
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Invoke-RestMethod (dm9rZS1SZXN0TWV0) in DNS TXT Reponse
ET MALWARE Observed Win32/Lumma Stealer Related Domain (sanguen .courses) in TLS SNI
ET INFO Observed DNS Query to Actor Abused Online Service Domain (getenjoyment .net)
ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (saeam .com)
ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (edentista .com)
Page 47 of 92