Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,751 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to enumerate AWS S3 object lists, which could indicate data discovery activities. It specifically looks for HTTP requests to s3.amazonaws.com or .s3-website domains containing the string 'list' in the URI, with a threshold of 10 occurrences within 30 seconds from the same source.
This rule detects attempts to query system language and locale information via a web shell. It specifically looks for HTTP requests where the URI contains the case-insensitive string "systeminfo". This activity is indicative of an attacker using a web shell to gather reconnaissance about the compromised system's configuration.
This rule detects attempts to query system geographic location information by monitoring HTTP requests to known IP lookup services such as ip-api.com, ipinfo.io, and freegeoip. The rule triggers an alert if five or more such requests are observed from the same source within a 30-second window, indicating potential reconnaissance or network scanning activity.
This rule detects attempts to enumerate Kubernetes namespaces by looking for HTTP requests to the '/api/v1/namespaces' endpoint on port 8080. This activity could indicate an attacker attempting to discover available namespaces within a Kubernetes cluster.
This rule detects potential HTML smuggling attempts where a malicious payload is delivered via a Blob URL. It specifically looks for HTTP responses (flow:to_client) that contain both 'URL.createObjectURL' and 'Blob(' (case-insensitive) in the file data. This combination is indicative of JavaScript code creating a Blob object and then generating a URL for it, which can be used to deliver files directly to the client's browser, bypassing traditional network security controls.
This rule detects the delivery of a stripped binary, specifically an executable (indicated by 'MZ' header) that has been packed or compressed using UPX (indicated by 'UPX' string). The rule triggers on HTTP traffic flowing to the client, suggesting a download or delivery of such a file. The 'Stripped Binary Delivered with Debug Info Removed' message implies an attempt to evade detection or analysis by removing debugging information, often associated with malware or unwanted applications.
This rule detects HTTP traffic where the host header contains specific cloud region identifiers that are considered rarely used. The rule is triggered if 10 such events occur within 60 seconds from the same source IP address. The identified regions are 'ap-east-1', 'me-south-1', 'af-south-1', and 'eu-south-1'. This could indicate an attempt to evade detection by using less common cloud infrastructure or an unauthorized API call from an unusual geographic location.
This rule detects the delivery of a kernel rootkit module, specifically a Linux Kernel Module (LKM) or a Windows system file, over HTTP. It looks for HTTP responses where the URI ends with '.ko' (Kernel Object for Linux) or '.sys' (system file for Windows) and the file data contains the 'ELF' magic bytes, indicating an Executable and Linkable Format file, which is common for Linux executables and modules. This combination suggests an attempt to deliver a malicious kernel module.
This rule detects potential steganography where a payload is embedded within an image file, specifically a JPEG. It triggers when an HTTP response contains JPEG magic bytes (`FF D8 FF`) within the first 3 bytes, and the file size is unusually large (over 1MB), suggesting additional data might be hidden within the image. The rule also includes a threshold to prevent excessive alerts from legitimate large images.
This rule detects network traffic, specifically HTTP responses (flow:to_client), that contain the strings "GetProcAddress" and "LoadLibraryA" (case-insensitive). These strings are commonly associated with dynamic API resolution techniques used by malware to load functions at runtime, often to evade static analysis. The rule is classified as detecting trojan activity.
Page 164 of 211