Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,751 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects HTTP traffic where the User-Agent header contains "MSHTML", indicating potential remote script execution via Mshta. Mshta.exe is a Microsoft utility that can execute HTML Application (HTA) files, which can contain scripts. Attackers often abuse Mshta to execute malicious scripts, bypassing traditional execution policies. The rule specifically looks for outbound HTTP connections from the internal network ($HOME_NET) to any external destination, where the User-Agent string includes "MSHTML" (case-insensitive). This behavior is commonly associated with trojan activity and defense evasion tactics.
This rule detects potential in-memory PE loading without disk write by looking for specific strings in HTTP file data. It specifically searches for the strings "Assembly.Load(" and "Invoke(" (case-insensitive) within the HTTP response body (flow:to_client,established; file.data). This combination of strings is indicative of .NET applications dynamically loading assemblies into memory and then executing methods, which can be a technique used by malware to avoid writing executables to disk.
This rule detects the string "sekurlsa" within the HTTP URI, which is commonly associated with the Mimikatz tool attempting to dump credentials from the Local Security Authority Subsystem Service (LSASS) process. The detection is case-insensitive and targets traffic flowing from the client to the server.
This rule detects network traffic on port 445 (SMB) containing the string "SetFileSecurity" (case-insensitive). This string is associated with modifying file security descriptors, specifically Discretionary Access Control Lists (DACLs), which can be used by attackers to hide malicious files or achieve persistence by altering permissions.
This rule detects attempts to modify file permissions remotely via SMB by looking for the string "icacls" in TCP traffic directed to port 445 (SMB). The detection is case-insensitive and focuses on established connections flowing to the server. This activity is classified as trojan activity, suggesting an attacker might be attempting to alter file access controls on a remote system.
This rule detects attempts to use 'mavinject.exe' for DLL injection into a running process over HTTP. It specifically looks for HTTP requests containing 'mavinject' and '/INJECTRUNNING' in the URI, indicating a potential malicious use of the Mavinject utility for defense evasion.
This rule detects potential credential stuffing attacks by identifying HTTP requests to login pages that use user agents commonly associated with automated tools like 'python-requests', 'Go-http-client', or 'curl'. It triggers if 20 such requests are observed from the same source IP within 30 seconds, indicating a high volume automated attempt.
This rule detects JavaScript code being delivered to a client that attempts to capture form field data, specifically looking for 'document.querySelector', 'password', and 'fetch(' within HTTP response data. This behavior is indicative of an attempt to exfiltrate credentials from a login page.
This rule detects attempts to copy SSL private key files over SMB. It specifically looks for network traffic on port 445 (SMB) containing the strings ".key" and "private" (case-insensitive) in the data being sent to the server. This activity could indicate an attacker attempting to exfiltrate sensitive cryptographic material.
This rule detects HTTP requests that attempt to access the '.aws/credentials' file, which typically contains AWS access keys and secret keys. This indicates an attempt to discover or exfiltrate sensitive AWS credentials from a web server, potentially exposing cloud resources.
Page 167 of 211