Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,751 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to escalate privileges using 'sudo su -' over an SSH connection. It specifically looks for the string 'sudo su -' within TCP traffic on port 22, indicating a potential privilege escalation attempt after an SSH session has been established.
This rule detects attempts to deliver a setuid shell payload via a web shell. It specifically looks for HTTP requests containing both 'chmod' and '+s' (case-insensitive) in the URI, indicating an attempt to modify file permissions to set the setuid bit.
This rule detects the download of a payload that might be used in a User Account Control (UAC) bypass technique. It specifically looks for HTTP traffic where the URI contains keywords like 'uac.bypass', 'elevate', 'privesc', or 'bypassuac' (case-insensitive) and the file data starts with 'MZ', indicating a Windows executable.
This rule detects the creation of a new domain trust via LDAP by looking for specific content in TCP traffic on port 389 (LDAP). It specifically targets HTTP POST requests containing "(objectClass=trustedDomain)" in the payload, indicating an attempt to establish a new trust relationship between domains.
This rule detects the creation of a new domain account via LDAP. It specifically looks for TCP traffic on port 389 (LDAP) where the flow is to the server and established. The rule then inspects the content for the strings "(objectClass=user)" and "add" (case-insensitive), indicating an LDAP operation to add a new user object.
This rule detects attempts to add an SSH key to a server's authorized_keys file via a web shell. It specifically looks for HTTP POST requests where the URI content includes "authorized_keys". This activity is indicative of an attacker establishing persistence on a compromised server by adding their SSH key for future unauthorized access.
This rule detects attempts to add email delegate permissions via the Microsoft Graph API. It specifically looks for HTTP PATCH requests to 'graph.microsoft.com' with a URI containing 'mailboxSettings'. This activity could indicate an attacker attempting to gain unauthorized access to a user's mailbox by granting delegate access to another account, which is a common persistence technique.
This rule detects when additional cloud credentials (Access Keys) are added to an AWS IAM user. It specifically looks for HTTP traffic to 'iam.amazonaws.com' containing 'CreateAccessKey' in the URI, indicating an attempt to create new access keys.
This rule detects network traffic containing the string "/etc/rc" over SSH (port 22) to a server within the home network. This pattern suggests an attempt to modify an RC script for persistence on a Linux system, potentially by an attacker who has gained SSH access.
This rule detects the deployment of a network logon script named 'logon.bat' within the 'SYSVOL' share over SMB (port 445). This activity is often associated with persistence techniques where an attacker modifies or creates logon scripts to execute malicious code when users log in to the domain.
Page 151 of 211