Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,751 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
Kerberos Realm Trust Discovery
Suricata
This rule detects Kerberos Realm Trust Discovery attempts by looking for specific byte patterns in TCP traffic destined for port 88 (Kerberos). The rule triggers if the byte sequence "6b 82" is found within the first 2 bytes of the payload. A threshold is applied to prevent excessive alerts, triggering if 10 such events occur from the same source within 30 seconds.
Sitemap File Discovery Access
Suricata
This rule detects HTTP requests to URIs that contain both 'sitemap' and '.xml' (case-insensitive). This pattern is commonly associated with the discovery of sitemap files, which are used by search engines to crawl websites. Attackers or reconnaissance tools might access these files to map out a website's structure and discover hidden or unlinked pages, which can then be used for further attacks.
This rule detects potential GitHub organization repository enumeration by monitoring HTTP traffic to api.github.com with URIs containing '/orgs/'. A threshold of 20 requests within 60 seconds from a single source IP address is used to trigger an alert, indicating a possible network scan or reconnaissance activity targeting GitHub organizations.
This rule detects attempts to fingerprint a browser's configuration using JavaScript by looking for the presence of 'navigator.userAgent' and 'navigator.platform' within HTTP response data. This technique is often used during reconnaissance phases by attackers to gather information about a target's browser environment.
This rule detects HTTP requests to 'api.shodan.io', indicating a potential query to the Shodan Internet Scan Database. This activity could be part of reconnaissance efforts by an attacker or security researcher to gather information about internet-connected devices and services.
This rule detects HTTP requests to known Certificate Transparency (CT) log query services such as crt.sh, censys.io, and certspotter.com. These services are often used by attackers during the reconnaissance phase to gather information about an organization's SSL certificates and subdomains.
This rule detects HTTP requests to VirusTotal's domain lookup service (www.virustotal.com/domain/). This activity is often associated with passive DNS lookups, which can be part of reconnaissance efforts by attackers or security researchers to gather information about a target's infrastructure.
This rule detects HTTP requests made to the SecurityTrails API (api.securitytrails.com). SecurityTrails is a service that provides access to passive DNS databases and other domain-related intelligence. Such queries can indicate reconnaissance activity by an attacker or security researcher gathering information about a target domain.
This rule detects HTTP requests where the User-Agent header contains the string "feroxbuster" (case-insensitive). Feroxbuster is a command-line tool used for content discovery on web servers, often employed in penetration testing or reconnaissance phases to find hidden directories and files. Detecting its User-Agent can indicate an active directory brute-force or content discovery scan against the network.
Stealth XMAS Scan Port Probe
Suricata
This rule detects a Stealth XMAS Scan Port Probe. An XMAS scan is a type of port scan where the FIN, PSH, and URG flags are set in the TCP header. This type of scan attempts to determine if a port is open by exploiting the TCP RFC 793. If a port is closed, the target system should respond with an RST packet. If the port is open, no response is expected. The rule specifically looks for TCP packets with the FPU (FIN, PSH, URG) flags set, originating from any source IP and port, destined for any IP on the local network ($HOME_NET) on any port. A threshold is applied to trigger an alert if 10 such packets are observed from the same source within a 30-second window, indicating a scanning activity.
Page 169 of 211