Darshan Thummar
@MightyCompletionist
1 follower18 downloads694 copies5 likes8,751 views
2,107 detections
Filters
Last updated
All Time
Detection languages
1,335
772
Categories
696
574
337
315
284
Platforms
1,363
586
192
85
85
Products / Services
1,327
297
79
39
34
MITRE Techniques
525
343
321
228
207
CVEs
1
1
IDS Classtypes
592
177
160
120
93
IDS Protocols
747
411
58
44
30
This rule detects attempts to exploit the Heartbleed vulnerability (CVE-2014-0160) by identifying a specific pattern in TLS heartbeat requests. It looks for a TLS heartbeat request with a type of 0x18 (heartbeat request) and a length greater than 3 bytes, which is indicative of an oversized heartbeat request used in the Heartbleed exploit.
This rule detects attempts to exploit the Shellshock Bash vulnerability via CGI. It specifically looks for HTTP requests containing the string "() {" in the header, which is characteristic of the Shellshock exploit payload used to inject arbitrary commands.
This Suricata rule detects Kerberos unconstrained delegation abuse by looking for a specific byte sequence in UDP traffic destined for port 88 (Kerberos). The byte sequence '|a0 03 02 01 05 a1 03 02 01 0d|' is indicative of a specific Kerberos message structure that can be associated with unconstrained delegation. Unconstrained delegation allows a service to impersonate any user to any other service on the network, which can be abused by attackers for privilege escalation and lateral movement.
Remote LSASS Memory Dump via SMB
Suricata
This rule detects attempts to remotely dump the LSASS process memory over SMB. It specifically looks for the string "lsass.exe" within TCP traffic destined for port 445 (SMB) on the home network. This activity is indicative of an attacker trying to extract credentials from a compromised system.
This rule detects attempts to modify Group Policy Objects (GPOs) over Server Message Block (SMB) by looking for HTTP PUT requests containing '\SYSVOL\' and '\Policies\' in the URI. This activity can indicate an adversary attempting to escalate privileges or establish persistence within an Active Directory domain.
Remote AT Scheduled Job Creation
Suricata
This rule detects attempts to create scheduled jobs remotely using the 'atsvc' service, typically associated with the Windows Task Scheduler. It specifically looks for TCP traffic on port 445 (SMB) containing the string 'atsvc' in an established flow to the home network. This activity can be indicative of an adversary establishing persistence or executing code remotely.
This Suricata rule detects HTTP requests containing 'VBoxService' in the URI. This string is associated with VirtualBox Guest Additions, which are often installed in virtualized environments. The presence of such a string in network traffic can indicate that a system is a virtual machine, which attackers or malware might query to detect if they are running in a sandbox or virtualized analysis environment. This detection is categorized as 'trojan-activity' and is related to discovery tactics.
HTTPS Server Banner Grabbing
Suricata
This rule detects HTTPS server banner grabbing attempts. It triggers an alert when a client sends 20 or more 'HEAD' HTTP requests to an HTTPS server on port 443 within a 30-second window, indicating an attempt to gather information about the server.
LDAP Password Policy Enumeration
Suricata
This rule detects attempts to enumerate LDAP password policy settings by looking for specific content within TCP traffic on port 389 (LDAP). Specifically, it triggers when it finds "(objectClass=domain)" and "pwdHistoryLength" in a case-insensitive manner within the network flow, indicating a query for password history length attribute of a domain object. This activity is often associated with reconnaissance or discovery phases of an attack.
This rule detects ICMP (Internet Control Message Protocol) packets that are characteristic of a traceroute operation, specifically those with a Time-To-Live (TTL) value less than 5. Traceroute is a network diagnostic tool used to display the route and measure transit delays of packets across an Internet Protocol (IP) network. Adversaries can use this technique for network topology discovery to map out the network infrastructure.
Page 172 of 211