Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,751 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to write shell event hook scripts, specifically those using 'trap' and 'SIGHUP', over an SSH connection. This activity is often associated with persistence mechanisms where an attacker sets up a script to execute upon certain shell signals, such as a hangup signal, to maintain access or execute malicious code.
This rule detects attempts to remotely create or modify services on a target system via SMB, specifically looking for the 'CreateService' string within TCP traffic on port 445. It thresholds on 3 occurrences from the same source within 60 seconds to reduce false positives.
This rule detects attempts to deploy a Kubernetes CronJob via the Kubernetes API. It specifically looks for HTTP requests targeting the '/apis/batch' and 'cronjobs' URI paths, indicating an interaction with the batch API group for CronJob resources. This could be an indicator of an attacker attempting to establish persistence or execute malicious code within the Kubernetes cluster by scheduling tasks.
Azure REST API Command Execution
Suricata
This rule detects HTTP POST requests to the Azure management API (management.azure.com). A high volume of such requests (20 within 10 seconds from the same source) could indicate automated activity, potentially related to command execution or resource manipulation within an Azure environment.
This rule detects attempts to retrieve the running configuration of a network device via an SSH session. It specifically looks for the case-insensitive string "show running-config" in TCP traffic destined for port 22 (SSH) on the home network, indicating a potential administrative action or reconnaissance activity.
This rule detects the download of JavaScript files (.js or .jse extensions) over HTTP that contain the string "WScript.Shell" (case-insensitive). This string is often used in malicious JavaScript to interact with the Windows operating system, indicating potential trojan activity.
This rule detects the download of ISO, IMG, VHD, or VHDX files over HTTP that are larger than 500KB. These file types are often used as containers for malware delivery, allowing attackers to bypass traditional file-based security controls by embedding malicious executables or scripts within disk images.
This rule detects the download of a potentially malicious LNK shortcut file over HTTP. It specifically looks for HTTP responses (flow:to_client) containing a URI with ".lnk" (nocase) and the byte sequence "|4C 00 00 00|" at the beginning of the file data (depth:4), which is characteristic of an LNK file header. This activity is often associated with initial access or execution techniques where attackers use shortcut files to deliver malware or execute malicious commands.
This rule detects HTTP traffic directed to 'management.azure.com' with a URI containing 'runCommand'. This pattern indicates an attempt to execute a command on an Azure Virtual Machine using the Azure Run Command feature. This activity is often associated with administrative actions or potential malicious execution on cloud resources.
This rule detects HTTP POST requests to Azure Function or Azure Website domains. It specifically looks for hostnames ending in '.azurewebsites.net' or containing '.azurefunctions.' in a case-insensitive manner. A threshold of 20 such requests from the same source within 60 seconds triggers the alert, indicating potential automated activity or remote execution attempts against Azure-hosted applications.
Page 154 of 211