Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,751 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Exposed Git Repository Discovery
Suricata
This rule detects attempts to discover exposed Git repositories on a web server. It triggers when an HTTP request URI contains the string "/.git/", indicating a client is probing for the presence of a Git repository's internal structure. This is a common reconnaissance technique used by attackers to find sensitive information or source code.
This rule detects the presence of the Acunetix Web Vulnerability Scanner based on its unique User-Agent string in HTTP traffic. It specifically looks for the case-insensitive string "acunetix" within the HTTP User-Agent header in traffic flowing from the internal network to an external server.
This rule detects the download of remote support tools such as AnyDesk, TeamViewer, Atera, Splashtop, and ConnectWise. The detection is based on HTTP URI patterns that match these tool names. This activity is often associated with phone scams where attackers trick users into installing remote access software, giving the attackers control over their systems.
This rule detects potential reverse proxy phishing pages by looking for HTTP URI requests that contain the keywords 'verify', 'account', and 'secure' (case-insensitive). The presence of these keywords in the URI of an HTTP request, particularly when combined, can indicate an attempt to mimic legitimate login or account verification pages, often used in phishing attacks.
This rule detects phishing emails sent over SMTP that contain macro-enabled documents (Word or Excel files) as attachments. It specifically looks for base64 encoded content, the 'filename=' attribute, and uses a PCRE to identify common macro-enabled file extensions like .doc, .docx, .xls, .xlsm, and .xlsb within the filename.
This rule detects phishing emails that deliver survey or form lures by identifying specific content patterns within SMTP traffic. It looks for emails with 'Content-Type: application/' and 'filename=' headers, specifically targeting attachments with file extensions like .doc, .docx, .pdf, or .xlsx, which are commonly used in social engineering attacks to deliver malicious documents or forms.
This rule detects network connections to known threat intelligence vendor portals. It specifically looks for HTTP traffic where the host header matches one of the specified domains: intel471.com, ke-la.com, recordedfuture.com, or flashpoint.io. This could indicate an analyst or automated system accessing threat intelligence resources.
This rule detects enumeration of organization profiles on Crunchbase.com by monitoring HTTP traffic for connections to 'crunchbase.com' with a high frequency (15 times in 60 seconds) from a single source IP address. This behavior is indicative of a network scan or automated data collection activity.
This rule detects potential reconnaissance activity targeting investor relations pages on a web server. It triggers when a client makes 10 or more HTTP requests containing the word "investor" (case-insensitive) in the URI within a 30-second window. This could indicate an attacker attempting to gather information about a company's financial status, ownership, or other sensitive details often found on investor relations sections of websites.
This rule detects attempts to download raw payload files (PowerShell scripts, executables, DLLs, batch files, VBScripts, Python scripts, or shell scripts) from raw.githubusercontent.com. This activity is often associated with adversaries attempting to retrieve malicious tools or scripts from code repositories.
Page 146 of 211